@go-to-k/cdkd 0.294.9 → 0.294.11

package/dist/{deploy-engine-BTOCDCWf.js → deploy-engine-CMRU0DTu.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-QrNvZCe0.js";
+import { t as getCdkdVersion } from "./version-DIQcU8CA.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4683,6 +4683,41 @@ function orphansAfterRollback(previous, newlyOrphaned) {
 //#endregion
 //#region src/types/rollback-journal.ts
 const ROLLBACK_JOURNAL_VERSION = 1;
+function splitImportedOps(ops, segment, except = /* @__PURE__ */ new Set()) {
+	const marks = segment.importedResources ?? [];
+	const replay = [];
+	const imported = [];
+	const displaced = [];
+	for (const op of ops) {
+		const ofId = except.has(op.logicalId) ? [] : marks.filter((m) => m.logicalId === op.logicalId);
+		if (ofId.length === 0) replay.push(op);
+		else if (ofId.some((m) => isMarkFor(m, op)) && retainedOldPhysicalId(op) === void 0) imported.push(op);
+		else displaced.push(op);
+	}
+	return {
+		replay,
+		imported,
+		displaced
+	};
+}
+function journalOpPhysicalId(op) {
+	if (op.physicalId !== void 0) return op.physicalId;
+	const prev = op.previousState?.physicalId;
+	return op.changeType === "DELETE" && typeof prev === "string" && prev !== "" ? prev : void 0;
+}
+function retainedOldPhysicalId(op) {
+	if (op.changeType !== "UPDATE") return void 0;
+	const prev = op.previousState?.physicalId;
+	if (typeof prev !== "string" || prev === "") return void 0;
+	const prevType = op.previousState?.resourceType;
+	const oldType = op.previousResourceType ?? (typeof prevType === "string" && prevType !== "" ? prevType : void 0);
+	if (!(prev !== journalOpPhysicalId(op) || oldType !== void 0 && oldType !== op.resourceType)) return void 0;
+	return op.oldResourceRetained !== false ? prev : void 0;
+}
+function isMarkFor(mark, op) {
+	const own = journalOpPhysicalId(op);
+	return own !== void 0 && mark.logicalId === op.logicalId && mark.physicalId === own && mark.resourceType === op.resourceType;
+}
 var UnknownRollbackJournalVersionError = class extends Error {
 	foundVersion;
 	stackName;
@@ -4753,6 +4788,7 @@ function parseRollbackJournal(bodyString, stackName) {
 			seg["failedOperations"].forEach((op, i) => refuseMalformedOperation(shownStack, `segments[${s}].failedOperations[${i}]`, op));
 		}
 		if (seg["supersededLogicalIds"] !== void 0 && (!Array.isArray(seg["supersededLogicalIds"]) || !seg["supersededLogicalIds"].every((id) => typeof id === "string"))) refuseMalformed(shownStack, `segments[${s}].supersededLogicalIds must be an array of strings when present.`);
+		if (seg["importedResources"] !== void 0 && (!Array.isArray(seg["importedResources"]) || !seg["importedResources"].every((m) => typeof m === "object" && m !== null && typeof m["logicalId"] === "string" && typeof m["physicalId"] === "string" && typeof m["resourceType"] === "string"))) refuseMalformed(shownStack, `segments[${s}].importedResources must be an array of { logicalId, physicalId, resourceType } strings when present.`);
 		if (seg["runId"] !== void 0 && typeof seg["runId"] !== "string") refuseMalformed(shownStack, `segments[${s}].runId must be a string when present (got ${kind(seg["runId"])}).`);
 		if (seg["skipPrefix"] !== void 0 && typeof seg["skipPrefix"] !== "boolean") refuseMalformed(shownStack, `segments[${s}].skipPrefix must be a boolean when present (got ${kind(seg["skipPrefix"])}).`);
 		const reads = seg["previousCrossStackReads"];
@@ -5370,6 +5406,23 @@ var S3StateBackend = class {
 		addSupersededIds(newest, logicalIds);
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
+	async markRollbackJournalImported(stackName, region, marks) {
+		if (marks.length === 0) return [];
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return [];
+		const marked = /* @__PURE__ */ new Set();
+		for (const segment of journal.segments) {
+			const named = new Set([...segment.operations, ...segment.failedOperations ?? []].map((op) => op.logicalId));
+			const hits = marks.filter((m) => named.has(m.logicalId));
+			if (hits.length === 0) continue;
+			segment.importedResources = [...(segment.importedResources ?? []).filter((k) => !hits.some((m) => m.logicalId === k.logicalId)), ...hits.map((m) => ({ ...m }))];
+			for (const m of hits) marked.add(m.logicalId);
+		}
+		if (marked.size === 0) return [];
+		addSupersededIds(journal.segments[journal.segments.length - 1], [...marked]);
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return [...marked];
+	}
 	async dropRollbackJournalSegments(stackName, region, drop) {
 		const journal = await this.loadRollbackJournal(stackName, region);
 		if (!journal) return 0;
@@ -6077,7 +6130,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -6262,7 +6315,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$3(args)) return void 0;
+		if (!isPlainObject$4(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -6308,7 +6361,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$3(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$4(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -6408,7 +6461,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$3(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -6440,7 +6493,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$3(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -6583,7 +6636,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$3(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -6613,7 +6666,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if (typeof bag === "string" && isPlainObject$3(source)) {
+	if (typeof bag === "string" && isPlainObject$4(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -6623,7 +6676,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$3(source)) {
+	if (Array.isArray(bag) && isPlainObject$4(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -6651,7 +6704,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(source)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -6664,7 +6717,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$3(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$4(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -6726,8 +6779,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$3(a)) {
-		if (!isPlainObject$3(b)) return false;
+	if (isPlainObject$4(a)) {
+		if (!isPlainObject$4(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -6753,7 +6806,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$3(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$4(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -6781,7 +6834,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(source)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -6808,14 +6861,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$3(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$4(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$3(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$4(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -6825,8 +6878,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$3(source)) {
-		if (!isPlainObject$3(bag)) return false;
+	if (isPlainObject$4(source)) {
+		if (!isPlainObject$4(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -6917,13 +6970,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$3(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$4(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(refused) && isPlainObject$3(scanned)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(refused) && isPlainObject$4(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -7792,12 +7845,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$3(resolvedProperties) || !isPlainObject$3(sourceProperties)) return;
+	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$3(resolvedParameters) || !isPlainObject$3(sourceParameters)) return;
+	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7829,7 +7882,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$3(sourceLeaf)) return void 0;
+		if (!isPlainObject$4(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -10787,7 +10840,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -10827,7 +10880,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$2(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$3(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -10839,7 +10892,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -10852,7 +10905,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -10866,7 +10919,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -10880,10 +10933,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$2(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -10910,7 +10963,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$2(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15683,6 +15736,927 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
+//#endregion
+//#region src/deployment/assumed-conditions.ts
+const assumedConditionNames = /* @__PURE__ */ new WeakMap();
+function recordAssumedConditions(conditions, assumed) {
+	assumedConditionNames.set(conditions, assumed);
+}
+function conditionsAssumedFalse(conditions) {
+	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
+}
+
+//#endregion
+//#region src/deployment/masked-property-fingerprints.ts
+const FINGERPRINT_LAYOUT$1 = 1;
+const INPUT_FINGERPRINT_LAYOUT = 2;
+function canonicalJson$2(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+const REFUSED_FINGERPRINT = "refused:secret-in-template";
+const FINGERPRINT_PREFIX = "sha256:";
+const INPUT_FINGERPRINT_PREFIX = "inputs-sha256:";
+const TEXT_HALF_SEPARATOR = "+";
+function splitInputFingerprint(entry) {
+	const at = entry.indexOf(TEXT_HALF_SEPARATOR);
+	if (at < 0) return {
+		input: entry,
+		text: void 0
+	};
+	const text = entry.slice(at + 1);
+	return {
+		input: entry.slice(0, at),
+		text: text.startsWith(FINGERPRINT_PREFIX) ? text : void 0
+	};
+}
+function templateCarriesNeedle(templateValue, secrets) {
+	const text = canonicalJson$2(templateValue);
+	for (const needle of printingCorpusOf(secrets).keys()) {
+		if (needle.length < 4) continue;
+		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
+	}
+	return false;
+}
+function maskedPropertyFingerprint(templateValue) {
+	const digest = createHash("sha256").update(canonicalJson$2({
+		layout: FINGERPRINT_LAYOUT$1,
+		value: templateValue
+	})).digest("hex");
+	return `${FINGERPRINT_PREFIX}${digest}`;
+}
+var UnknownInput = class extends Error {};
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
+const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
+const NESTED_OUTPUT_PREFIX = "Outputs.";
+function carriesSecretValue(value, corpora) {
+	if (carriesSecretMask(value)) return true;
+	const text = canonicalJson$2(value);
+	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
+	for (const corpus of corpora) {
+		if (corpus === void 0) continue;
+		for (const needle of printingCorpusOf(corpus).keys()) {
+			if (needle.length === 0) continue;
+			if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
+		}
+	}
+	return false;
+}
+function parameterInputsFor(args) {
+	const declared = isPlainObject$2(args.template.Parameters) ? args.template.Parameters : {};
+	const values = args.values ?? {};
+	const inputs = /* @__PURE__ */ new Map();
+	const bound = {};
+	for (const name of Object.keys(declared)) {
+		const definition = declared[name];
+		if (args.unbound?.has(name) || !Object.hasOwn(values, name)) {
+			inputs.set(name, { kind: "unknown" });
+			continue;
+		}
+		const value = values[name];
+		let secret = isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true") || carriesSecretValue(value, []);
+		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
+			if (Object.hasOwn(args.supplied, name)) {
+				const passed = args.passedClasses?.get(name);
+				if (passed === "unknown") {
+					inputs.set(name, { kind: "unknown" });
+					continue;
+				}
+				if (passed !== "clean") secret = true;
+			}
+		}
+		if (secret) inputs.set(name, { kind: "secret" });
+		else {
+			inputs.set(name, {
+				kind: "value",
+				value
+			});
+			bound[name] = value;
+		}
+	}
+	return {
+		parameterInput: (name) => inputs.get(name) ?? { kind: "unknown" },
+		bound
+	};
+}
+function newShared() {
+	return {
+		steps: 0,
+		passed: /* @__PURE__ */ new Map(),
+		outputs: /* @__PURE__ */ new Map(),
+		rowsPassed: /* @__PURE__ */ new Map()
+	};
+}
+function subPlaceholders(text) {
+	const names = [];
+	for (const match of text.matchAll(/\$\{([^}]*)\}/g)) {
+		const body = match[1] ?? "";
+		if (body.startsWith("!") || body.length === 0) continue;
+		if (!names.includes(body)) names.push(body);
+	}
+	return names;
+}
+function intrinsicKey(value) {
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
+}
+const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$2]);
+function hasOpaqueAttributes(logicalId, walk) {
+	const definition = walk.resources[logicalId];
+	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
+	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
+}
+function getAttTarget(operand) {
+	if (Array.isArray(operand) && typeof operand[0] === "string") return operand[0];
+	if (typeof operand === "string" && operand.includes(".")) return operand.split(".")[0];
+}
+function taintOf(logicalId, walk) {
+	const cached = walk.taint.get(logicalId);
+	if (cached !== void 0) return cached;
+	if (walk.inProgress.has(logicalId)) return "tainted";
+	walk.inProgress.add(logicalId);
+	let unknown = false;
+	const nameTaint = (name) => {
+		if (name.startsWith("AWS::")) return "clean";
+		if (Object.hasOwn(walk.resources, name)) return taintOf(name, walk);
+		if (Object.hasOwn(walk.parameters, name)) {
+			const input = walk.sources.parameterInput(name);
+			return input.kind === "value" ? "clean" : input.kind === "secret" ? "tainted" : "unknown";
+		}
+		return "tainted";
+	};
+	const visit = (value) => {
+		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
+		if (Array.isArray(value)) return value.some(visit);
+		if (!isPlainObject$2(value)) return false;
+		const key = intrinsicKey(value);
+		const operand = key === void 0 ? void 0 : value[key];
+		let verdict = "clean";
+		if (key === "Ref" && typeof operand === "string") verdict = nameTaint(operand);
+		else if (key === "Fn::GetAtt") {
+			const target = getAttTarget(operand);
+			verdict = target === void 0 || Object.hasOwn(walk.resources, target) && hasOpaqueAttributes(target, walk) ? "tainted" : nameTaint(target);
+		} else if (key === "Fn::ImportValue" || key === "Fn::GetStackOutput") verdict = "tainted";
+		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
+		else if (key === "Fn::Sub") {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			if (typeof text === "string") for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				const owner = name.includes(".") ? name.split(".")[0] : name;
+				const t = name.includes(".") && Object.hasOwn(walk.resources, owner) && hasOpaqueAttributes(owner, walk) ? "tainted" : nameTaint(owner);
+				if (t === "tainted") return true;
+				if (t === "unknown") unknown = true;
+			}
+		}
+		if (verdict === "tainted") return true;
+		if (verdict === "unknown") unknown = true;
+		return Object.values(value).some(visit);
+	};
+	const definition = walk.resources[logicalId];
+	const result = visit(isPlainObject$2(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	walk.inProgress.delete(logicalId);
+	walk.taint.set(logicalId, result);
+	return result;
+}
+function conditionInput(name, walk) {
+	const closure = conditionClosure(name, walk);
+	if (closure.unknown || closure.unread) return "unknown";
+	if (closure.secret) return "secret";
+	const conditions = walk.sources.conditions;
+	if (conditions === void 0 || !Object.hasOwn(conditions, name)) return "unknown";
+	if (conditionsAssumedFalse(conditions).has(name)) return "unknown";
+	const verdict = conditions[name];
+	return typeof verdict === "boolean" ? verdict : "unknown";
+}
+function conditionClosure(name, walk) {
+	const definitions = isPlainObject$2(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	let secret = false;
+	let unknown = false;
+	let unread = false;
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [name];
+	const visit = (value) => {
+		if (typeof value === "string") {
+			if (value.includes(DYNAMIC_REFERENCE_OPEN)) secret = true;
+			return;
+		}
+		if (Array.isArray(value)) {
+			value.forEach(visit);
+			return;
+		}
+		if (!isPlainObject$2(value)) return;
+		const keys = Object.keys(value);
+		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
+			pending.push(value["Condition"]);
+			return;
+		}
+		const classifyName = (ref) => {
+			if (ref.startsWith("AWS::")) return;
+			if (!Object.hasOwn(walk.parameters, ref)) {
+				unknown = true;
+				return;
+			}
+			const input = walk.sources.parameterInput(ref);
+			if (input.kind === "secret") secret = true;
+			if (input.kind === "unknown") unread = true;
+		};
+		if (keys.length === 1 && keys[0] === "Ref" && typeof value["Ref"] === "string") {
+			classifyName(value["Ref"]);
+			return;
+		}
+		const key = keys.length === 1 ? keys[0] : void 0;
+		if (key === "Fn::FindInMap") {
+			const read = mapReadClass(value["Fn::FindInMap"], walk.sources.template);
+			if (read === "secret") secret = true;
+			if (read === "unknown") unknown = true;
+		}
+		if (key === "Fn::ImportValue" || key === "Fn::GetStackOutput" || key === "Fn::GetAtt") {
+			secret = true;
+			return;
+		}
+		if (key === "Fn::Sub") {
+			const operand = value["Fn::Sub"];
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			if (typeof text === "string") for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
+				else classifyName(name);
+			}
+		}
+		Object.values(value).forEach(visit);
+	};
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (seen.has(current)) continue;
+		seen.add(current);
+		if (!Object.hasOwn(definitions, current)) {
+			unknown = true;
+			continue;
+		}
+		visit(definitions[current]);
+	}
+	return {
+		secret,
+		unknown,
+		unread
+	};
+}
+function mapReadClass(operand, template) {
+	const mapName = Array.isArray(operand) ? operand[0] : void 0;
+	if (typeof mapName !== "string") return "unknown";
+	const mappings = template.Mappings;
+	const map = isPlainObject$2(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$2(map)) return "unknown";
+	return carriesSecretValue(map, []) ? "secret" : "clean";
+}
+async function resolvedInput(node, walk) {
+	let resolved;
+	try {
+		resolved = await walk.sources.resolve(node);
+	} catch {
+		throw new UnknownInput();
+	}
+	if (resolved.keepAsWritten === true || carriesSecretValue(resolved.value, [resolved.secrets])) return {
+		form: node,
+		concrete: false
+	};
+	return {
+		form: resolved.value,
+		concrete: true
+	};
+}
+async function nameInput(name, node, walk) {
+	if (name === "AWS::NoValue") return {
+		form: node,
+		concrete: false
+	};
+	if (name.startsWith("AWS::")) return resolvedInput(node, walk);
+	if (Object.hasOwn(walk.resources, name)) {
+		const taint = taintOf(name, walk);
+		if (taint === "unknown") throw new UnknownInput();
+		if (taint === "tainted") return {
+			form: node,
+			concrete: false
+		};
+		return resolvedInput(node, walk);
+	}
+	if (Object.hasOwn(walk.parameters, name)) {
+		const input = walk.sources.parameterInput(name);
+		if (input.kind === "unknown") throw new UnknownInput();
+		if (input.kind === "secret") return {
+			form: node,
+			concrete: false
+		};
+		return {
+			form: input.value,
+			concrete: true
+		};
+	}
+	return {
+		form: node,
+		concrete: false
+	};
+}
+async function inputForms(values, walk) {
+	const parts = [];
+	for (const element of values) parts.push(await inputForm(element, walk));
+	return parts;
+}
+async function inputForm(value, walk) {
+	if (typeof value === "string") return {
+		form: value,
+		concrete: !value.includes(DYNAMIC_REFERENCE_OPEN)
+	};
+	if (Array.isArray(value)) {
+		const parts = await inputForms(value, walk);
+		return {
+			form: parts.map((p) => p.form),
+			concrete: parts.every((p) => p.concrete)
+		};
+	}
+	if (!isPlainObject$2(value)) return {
+		form: value,
+		concrete: true
+	};
+	const key = intrinsicKey(value);
+	if (key === void 0) {
+		const entries = Object.keys(value);
+		const parts = await inputForms(entries.map((k) => value[k]), walk);
+		return {
+			form: Object.fromEntries(entries.map((k, i) => [k, parts[i].form])),
+			concrete: parts.every((p) => p.concrete)
+		};
+	}
+	const operand = value[key];
+	switch (key) {
+		case "Ref": return typeof operand === "string" ? nameInput(operand, value, walk) : {
+			form: value,
+			concrete: false
+		};
+		case "Fn::GetAtt": {
+			const target = getAttTarget(operand);
+			if (target !== void 0 && isNestedStackRow(target, walk)) return nestedOutputInput(target, getAttAttribute(operand, target), value, walk);
+			if (target === void 0 || !Object.hasOwn(walk.resources, target) || hasOpaqueAttributes(target, walk)) return {
+				form: value,
+				concrete: false
+			};
+			if (Array.isArray(operand) && operand.length > 1 && typeof operand[1] !== "string") {
+				const attribute = await inputForm(operand[1], walk);
+				if (!attribute.concrete) return {
+					form: { [key]: [operand[0], attribute.form] },
+					concrete: false
+				};
+			}
+			return nameInput(target, value, walk);
+		}
+		case "Fn::If": {
+			if (!Array.isArray(operand) || typeof operand[0] !== "string") {
+				const args = await inputForm(operand, walk);
+				return {
+					form: { [key]: args.form },
+					concrete: false
+				};
+			}
+			const verdict = conditionInput(operand[0], walk);
+			if (verdict === "unknown") throw new UnknownInput();
+			if (verdict === "secret") {
+				const args = await inputForm(operand.slice(1), walk);
+				return {
+					form: { [key]: [operand[0], ...args.form] },
+					concrete: false
+				};
+			}
+			return inputForm(verdict ? operand[1] : operand[2], walk);
+		}
+		case "Fn::Sub": {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			if (typeof text !== "string") {
+				const args = await inputForm(operand, walk);
+				return {
+					form: { [key]: args.form },
+					concrete: false
+				};
+			}
+			const explicit = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = await inputForm(explicit, walk);
+			const placeholders = [];
+			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
+			for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(explicit, name)) continue;
+				const dot = name.indexOf(".");
+				const part = dot > 0 && !name.startsWith("AWS::") && isNestedStackRow(name.slice(0, dot), walk) ? await nestedOutputInput(name.slice(0, dot), name.slice(dot + 1), { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] }, walk) : dot > 0 && !name.startsWith("AWS::") ? Object.hasOwn(walk.resources, name.slice(0, dot)) && !hasOpaqueAttributes(name.slice(0, dot), walk) ? await nameInput(name.slice(0, dot), { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] }, walk) : {
+					form: { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] },
+					concrete: false
+				} : await nameInput(name, { Ref: name }, walk);
+				placeholders.push([name, part.form]);
+				concrete &&= part.concrete;
+			}
+			return {
+				form: { [key]: [
+					text,
+					vars.form,
+					Object.fromEntries(placeholders)
+				] },
+				concrete
+			};
+		}
+		case "Fn::ImportValue":
+		case "Fn::GetStackOutput":
+		case "Fn::FindInMap":
+		case "Fn::GetAZs": {
+			const args = await inputForm(operand, walk);
+			if (!args.concrete) return {
+				form: { [key]: args.form },
+				concrete: false
+			};
+			const resolved = await resolvedInput(value, walk);
+			return resolved.concrete ? resolved : {
+				form: { [key]: args.form },
+				concrete: false
+			};
+		}
+		default: {
+			const args = await inputForm(operand, walk);
+			return {
+				form: { [key]: args.form },
+				concrete: args.concrete
+			};
+		}
+	}
+}
+function newWalk(sources, nested = {
+	stackChain: /* @__PURE__ */ new Set(),
+	shared: newShared()
+}) {
+	return {
+		sources,
+		resources: isPlainObject$2(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$2(sources.template.Parameters) ? sources.template.Parameters : {},
+		taint: /* @__PURE__ */ new Map(),
+		inProgress: /* @__PURE__ */ new Set(),
+		stackChain: nested.stackChain,
+		shared: nested.shared
+	};
+}
+const NESTED_OUTPUT_ORDER = {
+	clean: 0,
+	unread: 1,
+	unknown: 2,
+	secret: 3
+};
+function worseOf(a, b) {
+	return NESTED_OUTPUT_ORDER[a] >= NESTED_OUTPUT_ORDER[b] ? a : b;
+}
+const MAX_NESTED_OUTPUT_DEPTH = 32;
+const MAX_NESTED_OUTPUT_STEPS = 1e4;
+function passedKey(passed) {
+	return JSON.stringify([...passed.entries()]);
+}
+function isNestedStackRow(logicalId, walk) {
+	if (!Object.hasOwn(walk.resources, logicalId)) return false;
+	const definition = walk.resources[logicalId];
+	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$2;
+}
+function getAttAttribute(operand, target) {
+	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
+	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
+}
+function rowParameters(definition) {
+	const properties = isPlainObject$2(definition) ? definition["Properties"] : void 0;
+	if (properties === void 0) return {};
+	if (!isPlainObject$2(properties)) return "unknown";
+	const parameters = properties["Parameters"];
+	if (parameters === void 0) return {};
+	if (!isPlainObject$2(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	return parameters;
+}
+function childParameterInputs(template, passed) {
+	const declared = isPlainObject$2(template.Parameters) ? template.Parameters : {};
+	const inputs = /* @__PURE__ */ new Map();
+	for (const name of Object.keys(declared)) {
+		const definition = declared[name];
+		if (isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true")) inputs.set(name, { kind: "secret" });
+		else if (passed.has(name)) {
+			const passedClass = passed.get(name);
+			inputs.set(name, passedClass === "clean" ? {
+				kind: "value",
+				value: void 0
+			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
+		} else if (isPlainObject$2(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+			kind: "value",
+			value: definition["Default"]
+		});
+		else inputs.set(name, { kind: "secret" });
+	}
+	return (name) => inputs.get(name) ?? { kind: "secret" };
+}
+function taintClass(taint) {
+	return taint === "clean" ? "clean" : taint === "tainted" ? "secret" : "unread";
+}
+function closureClass(closure) {
+	if (closure.secret) return "secret";
+	if (closure.unknown) return "unknown";
+	return closure.unread ? "unread" : "clean";
+}
+async function childOutputClass(loaded, outputName, passed, chain, shared) {
+	if (loaded === void 0 || !isPlainObject$2(loaded.template)) return "unknown";
+	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
+	const memoKey = JSON.stringify([scopeKey, outputName]);
+	const memo = shared.outputs.get(memoKey);
+	if (memo !== void 0) return memo;
+	const outputClass = await classifyChildOutput(loaded, outputName, passed, chain, shared, scopeKey);
+	shared.outputs.set(memoKey, outputClass);
+	return outputClass;
+}
+async function classifyChildOutput(loaded, outputName, passed, chain, shared, scopeKey) {
+	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
+	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
+	const template = loaded.template;
+	const output = (isPlainObject$2(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$2(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const scope = {
+		walk: newWalk({
+			template,
+			parameterInput: childParameterInputs(template, passed),
+			resolve: () => Promise.reject(/* @__PURE__ */ new Error("a nested output is classified, never resolved"))
+		}),
+		childTemplate: loaded.childTemplate,
+		chain: [...chain, loaded.identity],
+		rows: /* @__PURE__ */ new Set(),
+		key: scopeKey,
+		shared
+	};
+	let outputClass = "clean";
+	if (Object.hasOwn(output, "Condition")) {
+		const condition = output["Condition"];
+		outputClass = typeof condition === "string" ? closureClass(conditionClosure(condition, scope.walk)) : "unknown";
+	}
+	return worseOf(outputClass, await expressionClass(output["Value"], scope));
+}
+function nameClass(name, scope) {
+	if (name.startsWith("AWS::")) return "clean";
+	const walk = scope.walk;
+	if (Object.hasOwn(walk.resources, name)) return taintClass(taintOf(name, walk));
+	if (Object.hasOwn(walk.parameters, name)) {
+		const input = walk.sources.parameterInput(name);
+		return input.kind === "value" ? "clean" : input.kind === "secret" ? "secret" : "unread";
+	}
+	return "secret";
+}
+async function attributeClass(target, attribute, scope) {
+	const walk = scope.walk;
+	if (!Object.hasOwn(walk.resources, target)) return "secret";
+	if (isNestedStackRow(target, walk)) {
+		if (attribute === void 0 || !attribute.startsWith(NESTED_OUTPUT_PREFIX)) return "unknown";
+		if (scope.rows.has(target)) return "unknown";
+		const parameters = rowParameters(walk.resources[target]);
+		if (parameters === "unknown") return "unknown";
+		const rowKey = JSON.stringify([scope.key, target]);
+		let passed = scope.shared.rowsPassed.get(rowKey);
+		if (passed === void 0) {
+			const inner = {
+				...scope,
+				rows: /* @__PURE__ */ new Set([...scope.rows, target])
+			};
+			const classes = /* @__PURE__ */ new Map();
+			for (const [name, expression] of Object.entries(parameters)) {
+				const passedClass = await expressionClass(expression, inner);
+				classes.set(name, passedClass === "clean" ? "clean" : passedClass === "unread" ? "unknown" : "secret");
+			}
+			scope.shared.rowsPassed.set(rowKey, classes);
+			passed = classes;
+		}
+		let loaded;
+		try {
+			loaded = scope.childTemplate(target);
+		} catch {
+			loaded = void 0;
+		}
+		return childOutputClass(loaded, attribute.slice(8), passed, scope.chain, scope.shared);
+	}
+	if (hasOpaqueAttributes(target, walk)) return "unknown";
+	return taintClass(taintOf(target, walk));
+}
+async function expressionClass(value, scope) {
+	if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
+	const all = async (values) => {
+		let result = "clean";
+		for (const element of values) result = worseOf(result, await expressionClass(element, scope));
+		return result;
+	};
+	if (Array.isArray(value)) return all(value);
+	if (!isPlainObject$2(value)) return "clean";
+	const key = intrinsicKey(value);
+	if (key === void 0) return all(Object.values(value));
+	const operand = value[key];
+	switch (key) {
+		case "Ref": return typeof operand === "string" ? nameClass(operand, scope) : "unknown";
+		case "Fn::GetAtt": {
+			const target = getAttTarget(operand);
+			if (target === void 0) return "secret";
+			const attribute = getAttAttribute(operand, target);
+			return worseOf(attribute === void 0 && Array.isArray(operand) ? await all(operand.slice(1)) : "clean", await attributeClass(target, attribute, scope));
+		}
+		case "Fn::Sub": {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
+			result = worseOf(result, await all(Object.values(vars)));
+			for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				const dot = name.indexOf(".");
+				result = worseOf(result, dot > 0 && !name.startsWith("AWS::") ? await attributeClass(name.slice(0, dot), name.slice(dot + 1), scope) : nameClass(name, scope));
+			}
+			return result;
+		}
+		case "Fn::If":
+			if (!Array.isArray(operand) || operand.length !== 3 || typeof operand[0] !== "string") return worseOf("unknown", await expressionClass(operand, scope));
+			return worseOf(closureClass(conditionClosure(operand[0], scope.walk)), await all(operand.slice(1)));
+		case "Fn::ImportValue":
+		case "Fn::GetStackOutput": return "secret";
+		case "Fn::FindInMap": {
+			const read = mapReadClass(operand, scope.walk.sources.template);
+			if (read === "unknown") return worseOf("unknown", await all([operand]));
+			return worseOf(read, await all(operand.slice(1)));
+		}
+		default: return expressionClass(operand, scope);
+	}
+}
+async function stackOutputClass(stackLogicalId, attribute, walk) {
+	const loader = walk.sources.childTemplate;
+	if (loader === void 0 || !isNestedStackRow(stackLogicalId, walk)) return "unknown";
+	if (attribute === void 0 || !attribute.startsWith(NESTED_OUTPUT_PREFIX)) return "unknown";
+	if (walk.stackChain.has(stackLogicalId)) return "unknown";
+	const parameters = rowParameters(walk.resources[stackLogicalId]);
+	if (parameters === "unknown") return "unknown";
+	let passed = walk.shared.passed.get(stackLogicalId);
+	if (passed === void 0) {
+		if (++walk.shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
+		passed = await classifyPassed(parameters, walk.sources, {
+			stackChain: /* @__PURE__ */ new Set([...walk.stackChain, stackLogicalId]),
+			shared: walk.shared
+		});
+		walk.shared.passed.set(stackLogicalId, passed);
+	}
+	let loaded;
+	try {
+		loaded = loader(stackLogicalId);
+	} catch {
+		loaded = void 0;
+	}
+	return childOutputClass(loaded, attribute.slice(8), passed, [], walk.shared);
+}
+async function nestedOutputInput(stackLogicalId, attribute, node, walk) {
+	const outputClass = await stackOutputClass(stackLogicalId, attribute, walk);
+	if (outputClass === "unread") throw new UnknownInput();
+	if (outputClass !== "clean") return {
+		form: node,
+		concrete: false
+	};
+	return resolvedInput(node, walk);
+}
+async function maskedInputFingerprint(templateValue, sources) {
+	let form;
+	try {
+		form = (await inputForm(templateValue, newWalk(sources))).form;
+	} catch (error) {
+		if (error instanceof UnknownInput) return void 0;
+		throw error;
+	}
+	const digest = createHash("sha256").update(canonicalJson$2({
+		layout: INPUT_FINGERPRINT_LAYOUT,
+		value: form
+	})).digest("hex");
+	return `${INPUT_FINGERPRINT_PREFIX}${digest}${TEXT_HALF_SEPARATOR}${maskedPropertyFingerprint(templateValue)}`;
+}
+async function classifyPassedParameters(parameters, sources) {
+	return classifyPassed(parameters, sources, {
+		stackChain: /* @__PURE__ */ new Set(),
+		shared: newShared()
+	});
+}
+async function classifyPassed(parameters, sources, nested) {
+	const classes = /* @__PURE__ */ new Map();
+	if (!isPlainObject$2(parameters)) return classes;
+	for (const [name, expression] of Object.entries(parameters)) {
+		let passedClass;
+		try {
+			passedClass = (await inputForm(expression, newWalk(sources, nested))).concrete ? "clean" : "secret";
+		} catch {
+			passedClass = "unknown";
+		}
+		classes.set(name, passedClass);
+	}
+	return classes;
+}
+const passedParameterClasses = /* @__PURE__ */ new WeakMap();
+function recordPassedParameterClasses(bag, classes) {
+	passedParameterClasses.set(bag, classes);
+}
+function passedParameterClassesOf(bag) {
+	return bag === void 0 ? void 0 : passedParameterClasses.get(bag);
+}
+function inputFingerprinter(templateProps, sources) {
+	const memo = /* @__PURE__ */ new Map();
+	return (key) => {
+		let pending = memo.get(key);
+		if (pending === void 0) {
+			pending = Object.hasOwn(templateProps, key) ? maskedInputFingerprint(templateProps[key], sources).catch(() => void 0) : Promise.resolve(void 0);
+			memo.set(key, pending);
+		}
+		return pending;
+	};
+}
+function possiblyMaskedKeys(resolvedProps, corpora) {
+	const needles = /* @__PURE__ */ new Set();
+	for (const corpus of corpora) {
+		if (corpus === void 0) continue;
+		for (const needle of printingCorpusOf(corpus).keys()) if (needle.length > 0) needles.add(needle);
+	}
+	const short = [...needles].filter((needle) => needle.length < 4);
+	const long = [...needles].filter((needle) => needle.length >= 4);
+	const wholeShortLeaf = (value) => {
+		if (typeof value === "string") return short.includes(value);
+		if (Array.isArray(value)) return value.some(wholeShortLeaf);
+		if (isPlainObject$2(value)) return Object.values(value).some(wholeShortLeaf);
+		return false;
+	};
+	return Object.keys(resolvedProps).filter((key) => {
+		const value = resolvedProps[key];
+		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
+		const text = canonicalJson$2(value);
+		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
+	});
+}
+async function maskedInputFingerprintsFor(keys, fingerprinter) {
+	const entries = [];
+	for (const key of keys) {
+		const fingerprint = await fingerprinter(key);
+		if (fingerprint !== void 0) entries.push([key, fingerprint]);
+	}
+	return Object.fromEntries(entries);
+}
+function maskedPropertyFingerprintsFor(recordedProperties, templateProps) {
+	const entries = [];
+	for (const key of Object.keys(recordedProperties)) {
+		if (!Object.hasOwn(templateProps, key)) continue;
+		if (!carriesSecretMask(recordedProperties[key])) continue;
+		entries.push([key, maskedPropertyFingerprint(templateProps[key])]);
+	}
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function maskedPropertyFingerprintsOf(record) {
+	const read = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return read;
+	const field = record.maskedPropertyFingerprints;
+	if (!isPlainObject$2(field)) return read;
+	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
+	return read;
+}
+function maskedPropertyInputFingerprintsOf(record) {
+	const read = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return read;
+	const field = record.maskedPropertyInputFingerprints;
+	if (!isPlainObject$2(field)) return read;
+	const text = maskedPropertyFingerprintsOf(record);
+	for (const [key, value] of Object.entries(field)) {
+		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
+		const half = splitInputFingerprint(value).text;
+		if (half !== void 0 && text.get(key) === half) read.set(key, value);
+	}
+	return read;
+}
+function boundInputFingerprints(textFingerprints, inputFingerprints) {
+	if (textFingerprints === void 0 || inputFingerprints === void 0) return void 0;
+	const entries = [];
+	for (const [key, text] of Object.entries(textFingerprints)) {
+		if (!text.startsWith(FINGERPRINT_PREFIX) || !Object.hasOwn(inputFingerprints, key)) continue;
+		const input = inputFingerprints[key];
+		if (splitInputFingerprint(input).text === text) entries.push([key, input]);
+	}
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+async function movedMaskedProperties(record, templateProps, fingerprinter, onRebaseline) {
+	const recorded = maskedPropertyFingerprintsOf(record);
+	if (recorded.size === 0) return [];
+	const properties = record.properties;
+	if (properties === null || typeof properties !== "object") return [];
+	const inputs = maskedPropertyInputFingerprintsOf(record);
+	const moved = [];
+	for (const [key, fingerprint] of recorded) {
+		if (!Object.hasOwn(templateProps, key) || !Object.hasOwn(properties, key)) continue;
+		if (!carriesSecretMask(properties[key])) continue;
+		if (maskedPropertyFingerprint(templateProps[key]) !== fingerprint) {
+			moved.push(key);
+			continue;
+		}
+		if (fingerprinter === void 0) continue;
+		const bound = inputs.get(key);
+		if (bound === void 0 && onRebaseline === void 0) continue;
+		const now = await fingerprinter(key);
+		if (now === void 0) continue;
+		if (bound !== void 0) {
+			if (splitInputFingerprint(now).input !== splitInputFingerprint(bound).input) moved.push(key);
+		} else onRebaseline(key, now);
+	}
+	return moved;
+}
+function withRebaselinedFingerprints(record, fingerprints) {
+	const text = maskedPropertyFingerprintsOf(record);
+	const field = record.maskedPropertyInputFingerprints;
+	const next = isPlainObject$2(field) ? Object.entries(field) : [];
+	let changed = false;
+	for (const [key, value] of Object.entries(fingerprints)) {
+		if (text.get(key) !== splitInputFingerprint(value).text) continue;
+		const at = next.findIndex(([k]) => k === key);
+		if (at >= 0) next[at] = [key, value];
+		else next.push([key, value]);
+		changed = true;
+	}
+	return changed ? {
+		...record,
+		maskedPropertyInputFingerprints: Object.fromEntries(next)
+	} : record;
+}
+const writtenFromDeployedTemplate = /* @__PURE__ */ new WeakSet();
+function markWrittenFromDeployedTemplate(bag) {
+	writtenFromDeployedTemplate.add(bag);
+	return bag;
+}
+function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, secrets, noEchoParameterValues, inputFingerprints) {
+	if (templateProps === void 0) return scrubbed;
+	const corpora = [secrets, noEchoParameterValues].filter((corpus) => corpus !== void 0);
+	const written = writtenBag !== null && typeof writtenBag === "object" && writtenFromDeployedTemplate.has(writtenBag);
+	const { maskedPropertyFingerprints: previous, maskedPropertyInputFingerprints: previousInputs, ...rest } = scrubbed;
+	let fingerprints;
+	let inputs;
+	if (written) {
+		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
+		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
+	} else {
+		if (!isPlainObject$2(previous)) return scrubbed;
+		if (corpora.length === 0) return scrubbed;
+		fingerprints = { ...previous };
+		inputs = isPlainObject$2(previousInputs) ? { ...previousInputs } : void 0;
+	}
+	if (fingerprints !== void 0 && corpora.length > 0) {
+		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
+		if (refused.length > 0) {
+			fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [key, refused.includes(key) ? REFUSED_FINGERPRINT : value]));
+			if (inputs !== void 0) {
+				const kept = Object.entries(inputs).filter(([key]) => !refused.includes(key));
+				inputs = kept.length > 0 ? Object.fromEntries(kept) : void 0;
+			}
+		}
+	}
+	if (!written && JSON.stringify(fingerprints) === JSON.stringify(previous) && JSON.stringify(inputs) === JSON.stringify(previousInputs)) return scrubbed;
+	return {
+		...rest,
+		...fingerprints !== void 0 && { maskedPropertyFingerprints: fingerprints },
+		...inputs !== void 0 && { maskedPropertyInputFingerprints: inputs }
+	};
+}
+function backfillMaskedPropertyFingerprints(resources, template, noEchoParameterValues) {
+	const declared = template?.Resources;
+	if (declared === void 0 || declared === null) return 0;
+	let stamped = 0;
+	for (const [logicalId, record] of Object.entries(resources)) {
+		if (record === null || typeof record !== "object") continue;
+		const field = record.maskedPropertyFingerprints;
+		if (field !== void 0 && (field === null || typeof field !== "object" || Array.isArray(field))) continue;
+		const existing = field ?? {};
+		if (!Object.hasOwn(declared, logicalId)) continue;
+		const definition = declared[logicalId];
+		if (definition === void 0 || definition.Type !== record.resourceType) continue;
+		const properties = record.properties;
+		if (properties === null || typeof properties !== "object" || Array.isArray(properties)) continue;
+		const fingerprints = maskedPropertyFingerprintsFor(properties, definition.Properties ?? {});
+		if (fingerprints === void 0) continue;
+		const templateProps = definition.Properties ?? {};
+		const added = Object.entries(fingerprints).filter(([key]) => !Object.hasOwn(existing, key)).map(([key, value]) => noEchoParameterValues !== void 0 && templateCarriesNeedle(templateProps[key], noEchoParameterValues) ? [key, REFUSED_FINGERPRINT] : [key, value]);
+		if (added.length === 0) continue;
+		resources[logicalId] = {
+			...record,
+			maskedPropertyFingerprints: Object.fromEntries([...Object.entries(existing), ...added])
+		};
+		stamped++;
+	}
+	return stamped;
+}
+
 //#endregion
 //#region src/deployment/drain-budget.ts
 const drainDeadlines = new AsyncLocalStorage();
@@ -15980,6 +16954,49 @@ const DEPLOY_RESOLVED_REFERENCE_SERVICES = /* @__PURE__ */ new Set([
 	"ssm",
 	"ssm-secure"
 ]);
+function sitsInsideResolvableReference(text, start, end) {
+	const OPENING = "{{resolve:";
+	const opening = text.lastIndexOf(OPENING, start);
+	if (opening < 0) return false;
+	const head = text.slice(opening + 10, start);
+	if (head.includes("}}")) return false;
+	const colon = head.indexOf(":");
+	if (colon >= 0 && !DEPLOY_RESOLVED_REFERENCE_SERVICES.has(head.slice(0, colon))) return false;
+	const close = text.indexOf("}}", end);
+	if (close < 0) return false;
+	const nextOpening = text.indexOf(OPENING, end);
+	if (nextOpening >= 0 && nextOpening < close) return false;
+	return !/["\r\n]/.test(text.slice(opening, close));
+}
+const KEPT_PLACEHOLDERS = /* @__PURE__ */ new WeakMap();
+function recordKeptPlaceholder(bag, placeholder, because) {
+	let kept = KEPT_PLACEHOLDERS.get(bag);
+	if (kept === void 0) {
+		kept = /* @__PURE__ */ new Map();
+		KEPT_PLACEHOLDERS.set(bag, kept);
+	}
+	if (!kept.has(placeholder)) kept.set(placeholder, {
+		because,
+		reported: false
+	});
+}
+function takeKeptPlaceholdersInsideReferences(bag, text) {
+	const kept = KEPT_PLACEHOLDERS.get(bag);
+	if (kept === void 0) return [];
+	const found = [];
+	for (const [placeholder, entry] of kept) {
+		if (entry.reported) continue;
+		for (let at = text.indexOf(placeholder); at >= 0; at = text.indexOf(placeholder, at + 1)) if (sitsInsideResolvableReference(text, at, at + placeholder.length)) {
+			entry.reported = true;
+			found.push({
+				placeholder,
+				because: entry.because
+			});
+			break;
+		}
+	}
+	return found;
+}
 function keepsSecretReferenceToken(resolvedName) {
 	return dynamicReferenceTokens(resolvedName).some((token) => DEPLOY_RESOLVED_REFERENCE_SERVICES.has(token.slice(10, -2).split(":")[0] ?? ""));
 }
@@ -17766,6 +18783,13 @@ async function resolveTemplateLeafReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
 }
 async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited, persistedText = false) {
+	if (context?.abandonedResolutions !== void 0) {
+		const bag = context.abandonedResolutions;
+		for (const { placeholder, because } of takeKeptPlaceholdersInsideReferences(bag, value)) {
+			const reason = because instanceof Error ? because.message : String(because);
+			bag.push(this.abandonedUnit("placeholder", placeholder, new Error(`Fn::Sub kept the placeholder ${placeholder} (${reason}) inside a {{resolve:...}} reference, so that reference was never resolved`, { cause: because }), context, value));
+		}
+	}
 	const pattern = /\{\{resolve:([^}]+)\}\}/g;
 	let result = value;
 	let twin = logTwin;
@@ -18228,6 +19252,15 @@ function rethrowStructuralSubFailure(varName, error, context) {
 	if (!this.subPlaceholderNamesADeclaredTemplateEntity(varName, context)) return;
 	throw error;
 }
+function noteKeptSubPlaceholder(varName, placeholder, because, context) {
+	if (context.abandonedResolutions === void 0) return;
+	const firstDot = varName.indexOf(".");
+	const head = firstDot >= 0 ? varName.slice(0, firstDot) : varName;
+	for (const declared of [context.template?.Resources, context.template?.Parameters]) if (declared !== void 0 && declared !== null && typeof declared === "object") {
+		if (Object.hasOwn(declared, head)) return;
+	}
+	recordKeptPlaceholder(context.abandonedResolutions, placeholder, because);
+}
 function subListRefusal(subject, value, context) {
 	if (!Array.isArray(value)) return void 0;
 	const count = `${value.length} item${value.length === 1 ? "" : "s"}`;
@@ -18337,11 +19370,13 @@ async function resolveSub(subArgs, context, source) {
 					this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
 					this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, getAttError), context));
 					replacement = match[0];
+					noteKeptSubPlaceholder(varNameStr, match[0], getAttError, context);
 				}
 				else {
 					this.rethrowStructuralSubFailure(varNameStr, refError, context);
 					this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, refError), context));
 					replacement = match[0];
+					noteKeptSubPlaceholder(varNameStr, match[0], refError, context);
 				}
 			}
 		}
@@ -18858,16 +19893,6 @@ function displayLeaf(value, context) {
 	return this.displayMasked(this.logTextOfLeaf(value, context), context);
 }
 
-//#endregion
-//#region src/deployment/assumed-conditions.ts
-const assumedConditionNames = /* @__PURE__ */ new WeakMap();
-function recordAssumedConditions(conditions, assumed) {
-	assumedConditionNames.set(conditions, assumed);
-}
-function conditionsAssumedFalse(conditions) {
-	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/params-conditions.ts
 async function resolveParameters(template, userParameters, options) {
@@ -19409,7 +20434,7 @@ var DiffCalculator = class DiffCalculator {
 	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
 		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
 	}
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs) {
 		const changes = /* @__PURE__ */ new Map();
 		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
 		refuseMalformedResourceProperties(currentState, void 0, void 0);
@@ -19473,6 +20498,25 @@ var DiffCalculator = class DiffCalculator {
 				if (droppedKeys.length > 0) this.logger.warn(`${logicalId} (${desiredResource.Type}): part of the declared properties cannot be sent as declared and is ignored when comparing against deployed state — the provider narrows them (${droppedKeys.join(", ")}). Fix the template to declare only what the resource supports; until then changes to the ignored keys have no effect.`);
 				else if (canonicalizeProperties && !this.valuesEqual(desiredPropsForCompare, desiredAfterDrops)) this.logger.debug(`${logicalId} (${desiredResource.Type}): the provider normalizes part of the declared properties before sending them; the comparison uses the normalized form. Nothing is dropped.`);
 				const propertyChanges = await this.compareProperties(desiredResource.Type, currentPropsForCompare, desiredPropsForCompare, maskForLog);
+				const reported = new Set(propertyChanges.map((pc) => pc.path));
+				const rebaselined = [];
+				const moved = await movedMaskedProperties(currentResource, rawDesiredProps, maskedInputs && inputFingerprinter(rawDesiredProps, maskedInputs.sources), maskedInputs?.rebaselined && ((key, fingerprint) => rebaselined.push([key, fingerprint])));
+				if (rebaselined.length > 0) maskedInputs.rebaselined.set(logicalId, Object.fromEntries(rebaselined));
+				for (const key of moved) {
+					if (reported.has(key)) continue;
+					if (!Object.hasOwn(currentPropsForCompare, key)) continue;
+					if (!Object.hasOwn(desiredPropsForCompare, key)) continue;
+					const oldValue = currentPropsForCompare[key];
+					const newValue = desiredPropsForCompare[key];
+					propertyChanges.push({
+						path: key,
+						oldValue,
+						newValue,
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						maskedExpressionChanged: true
+					});
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed (go-to-k/cdkd#4451, go-to-k/cdkd#4543)`);
+				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -19839,6 +20883,11 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
+		if (this.replacementRules.isClassified(resourceType, key)) return false;
+		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
+	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
 	static isIntrinsic(value) {
 		if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
@@ -20779,7 +21828,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-3uLGAhIx.js");
+			const { ASGProvider } = await import("./asg-provider-CbHiTBaE.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -20885,7 +21934,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-J6zl27x3.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BQ-CGoYJ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-l9F4Y8YY.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CS-r4Ufj.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24938,30 +25987,47 @@ async function reserveStackCreateToken(options) {
 //#region src/deployment/inline-policy-claims.ts
 function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
 	const { selfLogicalId, writers, changes, stateResources } = args;
-	const same = (a, b) => typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
 	for (const [lid, write] of writers) {
 		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
 		const record = stateResources[lid];
 		if (record.provisionedBy === "cc-api") continue;
 		const props = record.properties ?? {};
 		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!same(record.physicalId, policyName)) continue;
+			if (!sameIamName(record.physicalId, policyName)) continue;
 			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => same(p, principal))) return true;
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
 			continue;
 		}
 		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
 		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!same(record.physicalId, principal)) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
 		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
 		const policies = props["Policies"];
 		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && same(entry["PolicyName"], policyName))) return true;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
 	}
 	return false;
 }
 var RollbackInlinePolicyWriters = class {
 	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
 	record(logicalId, write, record, policiesChanged, via) {
 		if (via === "cc-api") {
 			this.entries.delete(logicalId);
@@ -24993,15 +26059,100 @@ var RollbackInlinePolicyWriters = class {
 					}]
 				});
 			}
-			return isInlinePolicyClaimedByCompletedWriter({
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
 				selfLogicalId: logicalId,
 				writers,
 				changes,
 				stateResources
 			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
 		};
 	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
 };
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
 const IAM_NAME = /^[\w+=,.@-]+$/;
 const POLICY_LIST_FIELDS = {
 	role: "Roles",
@@ -25561,6 +26712,18 @@ function deploymentEventsIndexKey(prefix, stackName, region) {
 function deploymentsDirPrefix(prefix, stackName, region) {
 	return `${prefix}/${stackName}/${region}/deployments/`;
 }
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix) {
+	if (keys.length === 0) return;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
+	}
+}
 function runIdTimestampMs(runId) {
 	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
 	if (!m) return null;
@@ -25705,7 +26868,7 @@ var DeploymentEventsStore = class {
 			return runId !== null && runId < cutoff;
 		});
 		if (stale.length === 0) return;
-		await this.backend.deleteRawObjects(stale);
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
 		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
 	}
 	warnOnce(message) {
@@ -25797,7 +26960,7 @@ var DeploymentEventsReader = class {
 		const indexExisted = keys.includes(indexKey);
 		if (opts.all === true) {
 			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			await this.backend.deleteRawObjects([...toDelete, indexKey]);
+			await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix);
 			return {
 				deletedRunIds: runIdsDesc,
 				remainingRunIds: [],
@@ -25823,35 +26986,39 @@ var DeploymentEventsReader = class {
 		const deletedSet = new Set(candidates);
 		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
 		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		const indexDeleted = await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet, remainingRunIds.length === 0, indexExisted);
-		await this.backend.deleteRawObjects(deleteKeys);
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
 		return {
 			deletedRunIds: candidates,
 			remainingRunIds,
-			indexDeleted
+			indexDeleted: false
 		};
 	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds, noRunsRemain, indexExisted) {
-		if (noRunsRemain) {
-			await this.backend.deleteRawObjects([indexKey]);
-			return indexExisted;
-		}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
 		let raw;
 		try {
 			raw = await this.backend.getRawObject(indexKey);
 		} catch {
-			return false;
+			return;
 		}
-		if (raw === null) return false;
+		if (raw === null) return;
 		let parsed;
 		try {
 			parsed = JSON.parse(raw);
 		} catch {
-			return false;
+			return;
 		}
-		if (!Array.isArray(parsed.runs)) return false;
+		if (!Array.isArray(parsed.runs)) return;
 		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return false;
+		if (remaining.length === parsed.runs.length) return;
 		const file = {
 			indexVersion: 1,
 			stackName,
@@ -25860,7 +27027,6 @@ var DeploymentEventsReader = class {
 			lastModified: Date.now()
 		};
 		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
-		return false;
 	}
 };
 
@@ -25877,6 +27043,31 @@ function updatePartialMessage(reason) {
 	return `partial (${reason})`;
 }
 
+//#endregion
+//#region src/provisioning/redacted-delete-address.ts
+function isRedactedRecordedValue(value) {
+	if (carriesSecretMask(value)) return true;
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value);
+	} catch {
+		return false;
+	}
+	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
+}
+const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
+function redactedDeleteAddressFields(fields) {
+	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
+}
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
+	if (redactedFields.length === 0) return void 0;
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	return {
+		outcome: "skipped",
+		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
+	};
+}
+
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
@@ -26204,30 +27395,6 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
-//#endregion
-//#region src/deployment/producer-regions-scope.ts
-const producerRegionsStore = new AsyncLocalStorage();
-function withProducerRegions(evidence, fn) {
-	return producerRegionsStore.run(evidence, fn);
-}
-function getCurrentProducerRegions() {
-	return producerRegionsStore.getStore();
-}
-function inheritProducerRegions(own, inherited) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const region of [...own, ...inherited?.regions ?? []]) {
-		const canonical = canonicalizeRegion(region);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(region);
-	}
-	return {
-		regions,
-		complete: inherited?.complete === true
-	};
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/messages.ts
 function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
@@ -26371,6 +27538,271 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	};
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/names.ts
+function replayPrefixScope(input, logger, mask, restoring) {
+	const choice = replayPrefixChoice(input);
+	if (choice.kind === "not-applicable") return (fn) => fn();
+	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
+	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
+	const declared = choice.declared;
+	const secretDerived = declared !== void 0 && mask(declared) !== declared;
+	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
+	const shown = (value) => displayIdent(mask(String(value)));
+	const quoted = (value) => {
+		const masked = mask(value);
+		const rendered = displayIdent(masked);
+		return rendered === masked ? `"${masked}"` : rendered;
+	};
+	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
+	else if (choice.kind === "unreproduced" && restoring) {
+		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
+		const prop = safe(choice.property);
+		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
+		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
+	}
+	const skip = choice.skipPrefix;
+	return (fn) => withSkipPrefix(skip, fn);
+}
+function createOpMasker(logger, secrets) {
+	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
+	const pairs = [];
+	let sinks = base;
+	return {
+		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
+		addNamed: (record) => {
+			pairs.push(...secretDerivedNamePairs(record));
+			sinks = withDerivedNameMasks(logger, base, pairs);
+		}
+	};
+}
+const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::Cognito::UserPoolDomain": ["Domain"],
+	"AWS::Cognito::UserPoolUser": ["Username"],
+	"AWS::ECS::TaskDefinition": ["Family"],
+	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
+	"AWS::ElastiCache::User": ["UserId"],
+	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
+	"AWS::SES::EmailIdentity": ["EmailIdentity"]
+};
+const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
+const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
+function idNameSegments(id) {
+	const segments = /* @__PURE__ */ new Set();
+	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
+	if (arn !== null) {
+		const service = arn[1];
+		const resource = arn[2];
+		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
+		if (lambda !== null) {
+			segments.add(lambda[1]);
+			const qualifier = lambda[2];
+			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
+		} else {
+			const parts = resource.split(/[/:]/).filter((part) => part !== "");
+			let body = parts.length > 1 ? parts.slice(1) : parts;
+			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
+			for (const part of body) {
+				segments.add(part);
+				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
+			}
+		}
+	}
+	if (id.includes("/")) {
+		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
+		segments.add(afterSlash);
+		segments.add(afterSlash.replace(/:\d+$/, ""));
+	}
+	if (id.includes("|")) {
+		const parts = id.split("|");
+		parts.forEach((part, index) => {
+			if (part === "") return;
+			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
+			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
+			segments.add(part);
+		});
+	}
+	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
+}
+function ownEntry(table, key) {
+	return Object.hasOwn(table, key) ? table[key] : void 0;
+}
+function secretDerivedNamePairs(record) {
+	const { resourceType, properties, logicalId } = record;
+	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
+	const rewritten = reverseReplacementRewrittenNameTypes();
+	const named = /* @__PURE__ */ new Set();
+	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
+	if (typeof primary === "string") named.add(primary);
+	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
+	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
+	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
+		id,
+		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
+		finalSnapshotNamePrefix(id, resourceType),
+		...idNameSegments(id)
+	]);
+	const pairs = [];
+	for (const key of named) {
+		if (!Object.hasOwn(properties, key)) continue;
+		const value = properties[key];
+		if (typeof value !== "string" || value === "") continue;
+		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
+		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
+	}
+	return pairs;
+}
+function addRecordNames(opMasker, op, current) {
+	const { logicalId } = op;
+	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
+		resourceType: op.resourceType,
+		properties,
+		logicalId,
+		physicalIds: [op.physicalId]
+	});
+	for (const record of [op.previousState, current]) {
+		if (record === null || typeof record !== "object") continue;
+		opMasker.addNamed({
+			resourceType: record.resourceType ?? op.resourceType,
+			properties: record.properties,
+			logicalId,
+			physicalIds: [record.physicalId]
+		});
+	}
+}
+const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
+function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
+	if (isRestorableBag(bag)) return true;
+	if (bag === void 0) {
+		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
+		return false;
+	}
+	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
+}
+function isRestorableBag(bag) {
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
+	const { logicalId, resourceType } = op;
+	const physicalId = op.physicalId;
+	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
+		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
+		case "pre-delete-snapshot":
+			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
+				info: (message) => ctx.logger.info(mask(message)),
+				debug: (message) => ctx.logger.debug(mask(message))
+			});
+			return;
+		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+	}
+}
+
+//#endregion
+//#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
+async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
+	for (const removal of writers.takeHeldRemovals(stateResources)) await restoreOne(removal, stateResources, stackName, ctx, result, options.refuseAll === true);
+}
+async function restoreOne({ kind, holders, unreadable, unsettled }, stateResources, stackName, ctx, result, refuseAll) {
+	const { logger } = ctx;
+	const ids = [...new Set(holders.map((h) => h.logicalId))].map((id) => safe(id)).join(", ");
+	const lost = safeMsg`the ${kind} it is on lacks that inline policy until the resource is next updated, or ` + `'cdkd drift <stack> --revert' restores it`;
+	if (refuseAll || unsettled.length > 0) {
+		const pending = refuseAll ? ids : unsettled.map((id) => safe(id)).join(", ");
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, but the ` + safeMsg`rollback of ${pending} has not completed, so that record may be the failed ` + safeMsg`deploy's and cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (unreadable.length > 0) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, and ` + safeMsg`${unreadable.map((id) => safe(id)).join(", ")} may record it too under a redacted ` + safeMsg`name, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const documents = holders.map((h) => serializedDocument(h.document));
+	if (documents.some((d) => d === void 0)) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is still recorded by ${ids}, but its ` + safeMsg`recorded document is absent or redacted, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (new Set(documents).size > 1) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids} with different ` + safeMsg`documents under one name on one ${kind}, so cdkd put neither back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const holder = holders[0];
+	const secrets = /* @__PURE__ */ new Map();
+	for (const h of holders) {
+		const bag = ctx.logOnlyNeedlesFor?.(h.logicalId);
+		if (bag) carryLogOnlyValues(bag, secrets);
+	}
+	const masker = createOpMasker(logger, secrets);
+	for (const h of holders) {
+		const record = stateResources[h.logicalId];
+		addRecordNames(masker, {
+			logicalId: h.logicalId,
+			resourceType: record?.resourceType,
+			physicalId: record?.physicalId
+		}, record);
+	}
+	try {
+		const { provider, provisionedBy } = ctx.providerRegistry.getProviderFor({
+			resourceType: "AWS::IAM::Policy",
+			provisionedBy: "sdk"
+		});
+		if (provisionedBy !== "sdk") throw new Error("AWS::IAM::Policy is not routed to its SDK provider");
+		await provider.create(holder.logicalId, "AWS::IAM::Policy", {
+			PolicyName: holder.policyName,
+			PolicyDocument: holder.document,
+			[POLICY_LIST_FIELDS[kind]]: [holder.principal]
+		}, { maskSecrets: masker.mask });
+	} catch (error) {
+		logger.warn(maskedFailureText(safeMsg`  Rollback: could not put back the inline policy ${ids} records on its ${kind} ` + safeMsg`(${lost}): `, error, masker.mask));
+		result.warnings++;
+		return;
+	}
+	logger.info(safeMsg`  Rollback: put back the inline policy ${ids} records on its ${kind}`);
+	const holderType = stateResources[holder.logicalId]?.resourceType;
+	ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+		stackName,
+		operation: "UPDATE",
+		logicalId: holder.logicalId,
+		...typeof holderType === "string" && { resourceType: holderType },
+		provisionedBy: "sdk",
+		reason: `Put back the inline policy this resource records on its ${kind}, which the rollback had removed from it.`
+	});
+}
+function serializedDocument(document) {
+	if (typeof document === "string") return document.length > 0 && !isRedactedRecordedValue(document) ? document : void 0;
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return;
+	return isRedactedRecordedValue(document) ? void 0 : JSON.stringify(document);
+}
+
+//#endregion
+//#region src/deployment/producer-regions-scope.ts
+const producerRegionsStore = new AsyncLocalStorage();
+function withProducerRegions(evidence, fn) {
+	return producerRegionsStore.run(evidence, fn);
+}
+function getCurrentProducerRegions() {
+	return producerRegionsStore.getStore();
+}
+function inheritProducerRegions(own, inherited) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const region of [...own, ...inherited?.regions ?? []]) {
+		const canonical = canonicalizeRegion(region);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(region);
+	}
+	return {
+		regions,
+		complete: inherited?.complete === true
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-secrets.ts
 function replayProducerRegionEvidence(ctx) {
@@ -26590,7 +28022,7 @@ function classifyFailedOp(op, stateResources) {
 	if (op.changeType === "CREATE") {
 		if (!op.physicalId) return "skip-failed-unknown";
 		if (!current) return "skip-failed-noop";
-		if (current.physicalId !== op.physicalId) return "skip-failed-noop";
+		if (current.physicalId !== op.physicalId) return "skip-failed-mismatch";
 		const policy = effectiveDeletionPolicy(current.resourceType, current.deletionPolicy, current.properties);
 		if (policy === "Retain") return "orphan-failed-create-retain";
 		if (policy === "Snapshot") return "delete-failed-create-with-final-snapshot";
@@ -26674,167 +28106,6 @@ function sortRollbackCreates(createOps, stateResources, logger) {
 	return sorted;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/names.ts
-function replayPrefixScope(input, logger, mask, restoring) {
-	const choice = replayPrefixChoice(input);
-	if (choice.kind === "not-applicable") return (fn) => fn();
-	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
-	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
-	const declared = choice.declared;
-	const secretDerived = declared !== void 0 && mask(declared) !== declared;
-	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
-	const shown = (value) => displayIdent(mask(String(value)));
-	const quoted = (value) => {
-		const masked = mask(value);
-		const rendered = displayIdent(masked);
-		return rendered === masked ? `"${masked}"` : rendered;
-	};
-	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
-	else if (choice.kind === "unreproduced" && restoring) {
-		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
-		const prop = safe(choice.property);
-		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
-		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
-	}
-	const skip = choice.skipPrefix;
-	return (fn) => withSkipPrefix(skip, fn);
-}
-function createOpMasker(logger, secrets) {
-	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
-	const pairs = [];
-	let sinks = base;
-	return {
-		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
-		addNamed: (record) => {
-			pairs.push(...secretDerivedNamePairs(record));
-			sinks = withDerivedNameMasks(logger, base, pairs);
-		}
-	};
-}
-const OTHER_SPELLED_NAME_KEYS = {
-	"AWS::Cognito::UserPoolDomain": ["Domain"],
-	"AWS::Cognito::UserPoolUser": ["Username"],
-	"AWS::ECS::TaskDefinition": ["Family"],
-	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
-	"AWS::ElastiCache::User": ["UserId"],
-	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
-	"AWS::SES::EmailIdentity": ["EmailIdentity"]
-};
-const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
-const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
-function idNameSegments(id) {
-	const segments = /* @__PURE__ */ new Set();
-	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
-	if (arn !== null) {
-		const service = arn[1];
-		const resource = arn[2];
-		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
-		if (lambda !== null) {
-			segments.add(lambda[1]);
-			const qualifier = lambda[2];
-			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
-		} else {
-			const parts = resource.split(/[/:]/).filter((part) => part !== "");
-			let body = parts.length > 1 ? parts.slice(1) : parts;
-			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
-			for (const part of body) {
-				segments.add(part);
-				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
-			}
-		}
-	}
-	if (id.includes("/")) {
-		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
-		segments.add(afterSlash);
-		segments.add(afterSlash.replace(/:\d+$/, ""));
-	}
-	if (id.includes("|")) {
-		const parts = id.split("|");
-		parts.forEach((part, index) => {
-			if (part === "") return;
-			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
-			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
-			segments.add(part);
-		});
-	}
-	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
-}
-function ownEntry(table, key) {
-	return Object.hasOwn(table, key) ? table[key] : void 0;
-}
-function secretDerivedNamePairs(record) {
-	const { resourceType, properties, logicalId } = record;
-	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
-	const rewritten = reverseReplacementRewrittenNameTypes();
-	const named = /* @__PURE__ */ new Set();
-	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
-	if (typeof primary === "string") named.add(primary);
-	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
-	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
-	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
-		id,
-		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
-		finalSnapshotNamePrefix(id, resourceType),
-		...idNameSegments(id)
-	]);
-	const pairs = [];
-	for (const key of named) {
-		if (!Object.hasOwn(properties, key)) continue;
-		const value = properties[key];
-		if (typeof value !== "string" || value === "") continue;
-		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
-		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
-	}
-	return pairs;
-}
-function addRecordNames(opMasker, op, current) {
-	const { logicalId } = op;
-	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
-		resourceType: op.resourceType,
-		properties,
-		logicalId,
-		physicalIds: [op.physicalId]
-	});
-	for (const record of [op.previousState, current]) {
-		if (record === null || typeof record !== "object") continue;
-		opMasker.addNamed({
-			resourceType: record.resourceType ?? op.resourceType,
-			properties: record.properties,
-			logicalId,
-			physicalIds: [record.physicalId]
-		});
-	}
-}
-const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
-function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
-	if (isRestorableBag(bag)) return true;
-	if (bag === void 0) {
-		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
-		return false;
-	}
-	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
-}
-function isRestorableBag(bag) {
-	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
-}
-async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
-	const { logicalId, resourceType } = op;
-	const physicalId = op.physicalId;
-	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
-		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
-		case "pre-delete-snapshot":
-			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
-				info: (message) => ctx.logger.info(mask(message)),
-				debug: (message) => ctx.logger.debug(mask(message))
-			});
-			return;
-		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-	}
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
@@ -27410,6 +28681,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	};
 	if (operations.length === 0) {
 		ctx.logger.info("No completed operations to roll back.");
+		await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 		return result;
 	}
 	ctx.logger.info(`Rolling back ${operations.length} completed operation(s)...`);
@@ -27418,6 +28690,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 		stackName
 	});
 	const resolver = new ReplayResolvers(ctx.region);
+	inlinePolicyWriters.notePending(operations);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -27436,6 +28709,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 		}
 	}
+	await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
 	ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
@@ -27470,6 +28744,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		mask,
 		createRollbackRoute: void 0
 	};
+	const recordBefore = ownRecord(stateResources, op.logicalId);
 	try {
 		addRecordNames(opMasker, op, stateResources[op.logicalId]);
 		switch (action) {
@@ -27514,8 +28789,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			...failedRoute && { provisionedBy: failedRoute },
 			error: maskedRollbackEventError(rollbackError, mask)
 		});
+	} finally {
+		inlinePolicyWriters.noteOutcome(op, action === "skip-already-done" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 }
+function ownRecord(stateResources, logicalId) {
+	return Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+}
 async function replayFailedOperationsUnbound(failedOps, stateResources, stackName, ctx, options = {}) {
 	const inlinePolicyWriters = options.inlinePolicyWriters ?? new RollbackInlinePolicyWriters();
 	const result = {
@@ -27552,12 +28832,17 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 			mask
 		};
 		let createRollbackRoute;
+		const recordBefore = ownRecord(stateResources, op.logicalId);
 		try {
 			addRecordNames(opMasker, op, stateResources[op.logicalId]);
 			switch (action) {
 				case "skip-failed-noop":
 					logger.info(`  Rollback: failed ${safe(op.changeType)} of ${safe(op.logicalId)} (${safe(op.resourceType)}) left nothing to revert, skipping`);
 					break;
+				case "skip-failed-mismatch":
+					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it recorded ${mask(String(op.physicalId))}, which is not the resource state tracks under this id; manual attention may be required`);
+					recordRollbackSkip(skipScope, op, "The failed CREATE recorded a physical id other than the one state now tracks under this logical id, so the rollback left it as it is; manual attention may be required.");
+					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
@@ -27720,7 +29005,9 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
+	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
 		stackName
@@ -27763,7 +29050,7 @@ async function collectNestedChildUnaddressed(fn) {
 //#endregion
 //#region src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
-const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
 function nestedChildStackName(parentStackName, logicalId) {
 	return `${parentStackName}~${logicalId}`;
@@ -27780,8 +29067,46 @@ function nestedPendingSnapshot(state) {
 		}
 	};
 }
+function displacedPhysicalIdShown(op, logger, physicalId = journalOpPhysicalId(op)) {
+	if (physicalId === void 0) return void 0;
+	const masker = createOpMasker(logger, /* @__PURE__ */ new Map());
+	for (const properties of [
+		op.properties,
+		op.attemptedProperties,
+		op.previousState?.properties
+	]) {
+		if (properties === void 0) continue;
+		masker.addNamed({
+			resourceType: op.resourceType,
+			properties,
+			logicalId: op.logicalId,
+			physicalIds: [physicalId]
+		});
+	}
+	return displaySafe(String(masker.mask(physicalId)));
+}
+function displacedOpClause(op, marks, logger) {
+	const retainedOld = retainedOldPhysicalId(op);
+	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
+		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
+		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
+	}
+	const shownId = displacedPhysicalIdShown(op, logger);
+	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
+}
+function recordDisplacedSkips(recordEvent, stackName, ops) {
+	for (const op of ops) recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: "cdkd import has since put another resource under this logical id, so the op was not reverted; check the resource it recorded by hand"
+	});
+}
 function revertedNestedRowIds(ops) {
-	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE && op.changeType === "UPDATE").map((op) => op.logicalId);
+	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$1 && op.changeType === "UPDATE").map((op) => op.logicalId);
 }
 const revertRunStorage = new AsyncLocalStorage();
 function withNestedRevertRun(runId, fn) {
@@ -27807,7 +29132,7 @@ async function dropNestedChildJournals(args) {
 	if (!isPlainRecord(resources)) return;
 	if (depthExceeded(depth, parentStackName, logger)) return;
 	for (const [logicalId, record] of Object.entries(resources)) {
-		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE) continue;
+		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$1) continue;
 		const child = nestedChildStackName(parentStackName, logicalId);
 		try {
 			const data = await stateBackend.getState(child, region);
@@ -27965,8 +29290,9 @@ async function revertNestedChildFromJournal(args) {
 		for (let s = segments.length - 1; s >= 0; s--) {
 			const segment = segments[s];
 			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
+			const split = splitImportedOps(segment.operations, segment);
 			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
-				const replayed = await replayRollback(segment.operations, stateResources, childStackName, execCtx, {
+				const replayed = await replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
 					inlinePolicyWriters
@@ -27978,7 +29304,9 @@ async function revertNestedChildFromJournal(args) {
 				};
 			})))));
 			failures += result.failures;
-			warnings += result.warnings;
+			warnings += result.warnings + split.displaced.length;
+			recordDisplacedSkips(execCtx.recordEvent, childStackName, split.displaced);
+			for (const op of split.displaced) logger.warn(safeMsg`Nested stack ${childStackName}: ${op.logicalId} ` + safeMsg`${displacedOpClause(op, segment.importedResources ?? [], logger)}; ` + "not reverted, check that resource by hand");
 		}
 		restoring = failures === 0;
 		await save();
@@ -29264,9 +30592,9 @@ function extractAllDependencies(template, logicalId) {
 	return deps.length > 0 ? deps : void 0;
 }
 function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-	if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
+	if (result.effectiveProperties) return markWrittenFromDeployedTemplate(provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties);
 	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
-	return markSameGenerationBag(written);
+	return markWrittenFromDeployedTemplate(markSameGenerationBag(written));
 }
 function extractTemplateAttributes(template, logicalId) {
 	const resource = template?.Resources?.[logicalId];
@@ -29383,8 +30711,15 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
+	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
+	if (fingerprintSources !== void 0) this.perResourceInputFingerprints.set(logicalId, await maskedInputFingerprintsFor(possiblyMaskedKeys(resolvedProps, [
+		context.recordedSecretValues,
+		this.fingerprintNoEchoValues,
+		this.options.inheritedSecrets
+	]), inputFingerprinter(desiredProps, fingerprintSources)));
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(createSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
 	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -32276,12 +33611,22 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
 	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
 	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
+	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
+	const fingerprints = fingerprintSources && inputFingerprinter(desiredProps, fingerprintSources);
+	const movedMasked = new Set(await movedMaskedProperties(currentResource, desiredProps, fingerprints));
+	if (fingerprints !== void 0) this.perResourceInputFingerprints.set(logicalId, await maskedInputFingerprintsFor(possiblyMaskedKeys(resolvedProps, [
+		updateSecrets,
+		this.fingerprintNoEchoValues,
+		this.options.inheritedSecrets
+	]), fingerprints));
+	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
+	const recordMatchesDesired = movedMasked.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -32295,7 +33640,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		renderer.removeTask(logicalId);
 		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
 	};
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten)) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
@@ -32320,7 +33665,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				lowered.push(pc);
 				continue;
 			}
-			const moved = keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				lowered.push(pc);
@@ -32352,7 +33697,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		}
 		change.propertyChanges = lowered;
 	}
-	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten) && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
+	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
 		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		this.attemptedResolvedProps.delete(logicalId);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
@@ -34014,6 +35359,184 @@ function conditionVerdictRecordsEqual(a, b) {
 	return names.every((name) => Object.hasOwn(right, name) && left[name].verdict === right[name].verdict && left[name].fingerprint === right[name].fingerprint);
 }
 
+//#endregion
+//#region src/utils/nested-template-cycle.ts
+const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+function isAbsoluteAssetPath(p) {
+	return path.isAbsolute(p) || p.startsWith("/");
+}
+function templateIdentity(templatePath) {
+	const dir = path.dirname(templatePath);
+	let realDir;
+	try {
+		realDir = fs.realpathSync.native(dir);
+	} catch {
+		realDir = path.resolve(dir);
+	}
+	return path.join(realDir, path.basename(templatePath));
+}
+function listNestedTemplateRows(template) {
+	if (template === null || typeof template !== "object") return [];
+	const resources = template.Resources;
+	if (resources === null || resources === void 0) return [];
+	const rows = [];
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		const row = resource;
+		if (row?.Type !== NESTED_STACK_TYPE) continue;
+		const assetPath = row.Metadata?.["aws:asset:path"];
+		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
+		rows.push({
+			logicalId,
+			assetPath
+		});
+	}
+	return rows;
+}
+function readNestedRows(templatePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+	} catch {
+		return;
+	}
+	return listNestedTemplateRows(parsed);
+}
+const MAX_NESTING_DEPTH = 512;
+const MAX_ROWS_FOLLOWED = 1e4;
+function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = []) {
+	const onChain = /* @__PURE__ */ new Set();
+	for (const p of ancestorTemplatePaths) onChain.add(templateIdentity(p));
+	const clean = /* @__PURE__ */ new Set();
+	const chain = [];
+	let rowsFollowed = 0;
+	const visit = (logicalId, templatePath) => {
+		if (typeof templatePath !== "string") return void 0;
+		const identity = templateIdentity(templatePath);
+		const lexical = path.resolve(templatePath);
+		chain.push({
+			logicalId,
+			templatePath: identity
+		});
+		try {
+			if (onChain.has(identity)) return {
+				kind: "cycle",
+				chain: [...chain]
+			};
+			if (chain.length > 512) return {
+				kind: "too-deep",
+				chain: [...chain]
+			};
+			if (++rowsFollowed > 1e4) return {
+				kind: "too-large",
+				chain: [...chain]
+			};
+			if (clean.has(lexical)) return void 0;
+			const rows = readNestedRows(templatePath);
+			if (rows === void 0) return void 0;
+			onChain.add(identity);
+			try {
+				const dir = path.dirname(templatePath);
+				for (const row of rows) {
+					if (isAbsoluteAssetPath(row.assetPath)) return {
+						kind: "absolute-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath
+					};
+					const resolved = resolveAssemblyPath(dir, row.assetPath);
+					if (!resolved.contained) return {
+						kind: "escaping-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath,
+						escape: resolved,
+						dir
+					};
+					const defect = visit(row.logicalId, resolved.path);
+					if (defect) return defect;
+				}
+			} finally {
+				onChain.delete(identity);
+			}
+			clean.add(lexical);
+			return;
+		} finally {
+			chain.pop();
+		}
+	};
+	for (const [logicalId, templatePath] of Object.entries(nestedTemplates)) {
+		const defect = visit(logicalId, templatePath);
+		if (defect) return defect;
+	}
+}
+const MAX_RENDERED_HOPS = 8;
+function renderChain(chain) {
+	const hop = (h) => `${displayIdent(h.logicalId)} (${displayAssemblyPath(h.templatePath)})`;
+	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" then ");
+	const keep = MAX_RENDERED_HOPS / 2;
+	return [
+		...chain.slice(0, keep).map(hop),
+		`... ${chain.length - 8} more ...`,
+		...chain.slice(-4).map(hop)
+	].join(" then ");
+}
+function renderNestedTemplateTreeDefect(defect, stackName, action) {
+	const provenance = `CDK emits an acyclic nested template tree with relative asset paths, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const owner = (chain) => {
+		const ids = chain.slice(0, -1).map((h) => h.logicalId);
+		const keep = MAX_RENDERED_HOPS / 2;
+		if (ids.length <= MAX_RENDERED_HOPS) return displayStackName([stackName, ...ids].join("~"));
+		const head = displayStackName([stackName, ...ids.slice(0, keep)].join("~"));
+		const tail = displayStackName(ids.slice(-4).join("~"));
+		return `${head}~...${ids.length - 8} more...~${tail}`;
+	};
+	if (defect.kind === "cycle") {
+		const closing = defect.chain[defect.chain.length - 1];
+		return `The nested template tree under stack ${displayStackName(stackName)} contains a cycle: ${renderChain(defect.chain)}. Nested stack ${displayIdent(closing.logicalId)} (declared in stack ${owner(defect.chain)}) resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
+	}
+	if (defect.kind === "too-large") return `The nested template tree under stack ${displayStackName(stackName)} has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
+	if (defect.kind === "too-deep") return `The nested template tree under stack ${displayStackName(stackName)} nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
+	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
+}
+
+//#endregion
+//#region src/deployment/nested-output-templates.ts
+function childTemplateLoader(nestedTemplates) {
+	if (nestedTemplates === void 0) return void 0;
+	const read = /* @__PURE__ */ new Map();
+	const loaderOver = (index) => (logicalId) => {
+		const templatePath = index[logicalId];
+		if (typeof templatePath !== "string") return void 0;
+		const key = path.resolve(templatePath);
+		if (read.has(key)) return read.get(key);
+		let entry;
+		try {
+			const parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+			if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) entry = {
+				template: parsed,
+				identity: templateIdentity(templatePath),
+				childTemplate: loaderOver(childIndex(parsed, templatePath))
+			};
+		} catch {
+			entry = void 0;
+		}
+		read.set(key, entry);
+		return entry;
+	};
+	return loaderOver(nestedTemplates);
+}
+function childIndex(template, templatePath) {
+	const dir = path.dirname(templatePath);
+	const index = Object.create(null);
+	for (const { logicalId, assetPath } of listNestedTemplateRows(template)) {
+		if (isAbsoluteAssetPath(assetPath)) continue;
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (resolved.contained) index[logicalId] = resolved.path;
+	}
+	return index;
+}
+
 //#endregion
 //#region src/deployment/recreate-target-promotion.ts
 function recreateTargetIdsFor(recreateTargets, stackName) {
@@ -34118,6 +35641,17 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
+		this.fingerprintNoEchoValues = backfillNoEchoValues;
+		this.fingerprintParameters = parameterInputsFor({
+			template,
+			values: parameterValues,
+			nestedChild: this.options.parentStackInfo !== void 0,
+			supplied: this.options.parameters,
+			passedClasses: this.options.passedParameterClasses
+		});
+		this.fingerprintChildTemplates = childTemplateLoader(getCurrentNestedStackContext()?.nestedTemplates);
+		let maskedFingerprintsBackfilled = backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0;
 		const context = this.buildResolverContext({
 			template,
 			resources: currentState.resources,
@@ -34139,7 +35673,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
-		if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
+		if (Object.keys(orphanPlan.adopted).length > 0) {
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
+			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
+		}
 		const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 		const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 		this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -34165,8 +35702,19 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		diffResolverContext.bestEffort = true;
 		diffResolverContext.skipDynamicReferences = true;
 		const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName));
+		const maskedInputSourcesForDiff = this.maskedInputSources(effectiveTemplate, currentState.resources, conditions, stackName);
+		const maskedInputs = maskedInputSourcesForDiff && {
+			sources: maskedInputSourcesForDiff,
+			rebaselined: /* @__PURE__ */ new Map()
+		};
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs);
 		createOnlyPrefetch.cancel();
+		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
+			const record = currentState.resources[logicalId];
+			if (record === void 0) continue;
+			currentState.resources[logicalId] = withRebaselinedFingerprints(record, fingerprints);
+			maskedFingerprintsBackfilled = true;
+		}
 		const nestedStackTypeChanges = findNestedStackTypeChanges({
 			changes,
 			stateResources: currentState.resources
@@ -34216,7 +35764,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
-				if (observedRefresh || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
+				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
 						version: 10,
 						region: this.stackRegion,
@@ -34350,6 +35898,54 @@ function buildResolverContext(base, stackName) {
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
+function getAttTargetOf(node) {
+	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
+	const getAtt = node["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function maskedInputSources(template, resources, conditions, stackName) {
+	const parameters = this.fingerprintParameters;
+	if (parameters === void 0) return void 0;
+	return {
+		template,
+		parameterInput: parameters.parameterInput,
+		conditions,
+		childTemplate: this.fingerprintChildTemplates,
+		resolve: async (node) => {
+			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
+				template,
+				resources,
+				parameters: parameters.bound,
+				...conditions && { conditions }
+			}, stackName);
+			const context = {
+				...base,
+				recordedImports: [],
+				recordedOutputReads: [],
+				bestEffort: true,
+				skipDynamicReferences: true,
+				staleAttributeHeal: { phase: "probe" }
+			};
+			const value = await this.resolver.resolve(structuredClone(node), context);
+			const secrets = context.recordedSecretValues;
+			const target = getAttTargetOf(node);
+			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
+			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
+				const probe = { value };
+				const redacted = redactSecretsForState(probe, targetSecrets);
+				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
+					value,
+					keepAsWritten: true
+				};
+			}
+			return {
+				value,
+				...secrets && { secrets }
+			};
+		}
+	};
+}
 
 //#endregion
 //#region src/deployment/label-routing.ts
@@ -34573,6 +36169,10 @@ var DeployEngine = class {
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
+	fingerprintNoEchoValues = void 0;
+	fingerprintParameters = void 0;
+	fingerprintChildTemplates = void 0;
+	perResourceInputFingerprints = /* @__PURE__ */ new Map();
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
@@ -34620,6 +36220,10 @@ var DeployEngine = class {
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
+		this.fingerprintNoEchoValues = void 0;
+		this.fingerprintParameters = void 0;
+		this.fingerprintChildTemplates = void 0;
+		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
@@ -34646,13 +36250,15 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			resources[logicalId] = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
+			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -34768,6 +36374,7 @@ DeployEngine.prototype.recreateDirectionFor = recreateDirectionFor;
 DeployEngine.prototype.peekRoutingForLabel = peekRoutingForLabel;
 DeployEngine.prototype.preparePropertiesForCcApi = preparePropertiesForCcApi;
 DeployEngine.prototype.buildResolverContext = buildResolverContext;
+DeployEngine.prototype.maskedInputSources = maskedInputSources;
 DeployEngine.prototype.doDeployWithPrefetch = doDeployWithPrefetch;
 DeployEngine.prototype.executeDeployment = executeDeployment;
 DeployEngine.prototype.persistStateAfterOutputFailure = persistStateAfterOutputFailure;
@@ -34825,5 +36432,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { nestedChildStackName as $, importableOutputs as $a, describeTypeWithThrottleRetry as $i, coerceParameterTypedValue as $n, resolveStateBucketWithDefaultAndSource as $o, refuseMalformedOutputs as $r, acquireIdempotencyToken as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, pathCrossesDottedKey as Aa, findReplacedReadersOfRecreateTargets as Ai, reEnableInstanceApiTermination as An, formatDockerLoginError as Ao, malformedLocalResourceEntriesWarning as Ar, DeploymentEventsStore as At, gray as B, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ba, toFiniteNumber as Bi, explicitRoleArnOrThrow as Bn, escapeRegExp$2 as Bo, malformedResourceEntriesWarning as Br, noEchoParameterValueSeed as Bt, deleteBudgetKey as C, markSameGenerationBag as Ca, unreadableResourceEntries as Ci, isWaitAbandonedError as Cn, buildDockerImage as Co, hasReadableResources as Cr, absoluteAssemblyPathEscape as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, DYNAMIC_REFERENCE_TOKEN_SCAN as Da, withoutSilentDropProperties as Di, isTerminationProtectionPropagationError as Dn, describeDockerFailure as Do, malformedExportNamesWarning as Dr, resolveAssemblyPath as Ds, updatePartialMessage as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, recoverMaskedOutput as Ea, unwrittenCreateOnlyReplacement as Ei, ec2InstanceProtectionSite as En, describeDockerExecFailure as Eo, malformedDriftResourcePropertiesWarning as Er, renderAssemblyPathEscape as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, recordNoEchoAttributeValues as Fa, renderStatefulReason as Fi, producerRegionsFromState as Fn, redactDockerArgvValues as Fo, malformedOrphansRefusalMessage as Fr, secretBearing as Ft, namesAnyDeclaredParameter as G, rebuildClientForBucketRegion as Ga, configStringRefusal as Gi, callerEnvCredentials as Gn, synthesisStatusMessage as Go, previewableOrphanRecords as Gr, DEFAULT_RESOURCE_TIMEOUT_MS as Gt, red as H, LockManager as Ha, coerceCfnInteger as Hi, sendableAssumeRoleCommand as Hn, AssetManifestLoader as Ho, malformedResourcesWarning as Hr, collectPublishedOutputNames as Ht, formatResourceLine as I, STATE_SOURCED_BASELINE_RULES as Ia, WARM_THROUGHPUT_MEMBERS as Ii, regionLessSecretName as In, redactedDockerCause as Io, malformedOrphansWarning as Ir, secretBearingStateKeyWarning as It, makeSiblingClaimReader as J, exportNamesCarriedFrom as Ja, requireConfigArray as Ji, s3BucketArn as Jn, resolveApp as Jo, refuseMalformedOrphanRecords as Jr, RollbackInlinePolicyWriters as Jt, reachableDivergentParameters as K, acceptedCreateOnlyDropsOf as Ka, readConfigString as Ki, envCredentialsAreAssumedRole as Kn, getDefaultStateBucketName as Ko, refuseDivergentRecordRegionForDestroy as Kr, DEFAULT_RESOURCE_WARN_AFTER_MS as Kt, createReadOnlyAttributeHealerFactory as L, STATE_SOURCED_CROSS_GENERATION_RULES as La, coerceWarmThroughput as Li, applyRoleArnIfSet as Ln, runDockerForeground as Lo, malformedOutputsRefusalMessage as Lr, secretSafeKeyDisplay as Lt, hasCdkAutoDeleteTag as M, carriesSecretMask as Ma, MULTI_REGION_RECREATE_BLOCKED_TYPES as Mi, INTRINSIC_KEYS as Mn, isDockerClientEnvKey as Mo, malformedOrphanRecordsRefusalMessage as Mr, WITHHELD_NAME_DISPLAY as Mt, isTruthyCfnBoolean as N, recordMaskOnlyValue as Na, isStatefulRecreateTargetForReplace as Ni, IntrinsicFunctionResolver as Nn, isMalformedEnvKey as No, malformedOrphanRecordsWarning as Nr, displayTextOrWithheld as Nt, deleteTableWithIndexBusyRetry as O, dynamicReferenceTokens as Oa, NO_CC_HANDLERS_REASON as Oi, observeThenDisableInstanceApiTermination as On, dockerSpawnEnvWithSensitive as Oo, malformedExportSourceWarning as Or, clearBucketRegionCache as Os, updatePartialReason as Ot, getPriorAttempts as P, recordMaskOnlyValuesIn as Pa, isStatefulRecreateTargetSync as Pi, classifyReplaySecretRegion as Pn, partitionSensitiveEnv as Po, malformedOrphanRowsKeptWarning as Pr, exportAliasCollisionScrubWarning as Pt, getNestedRevertRun as Q, importableOutputKeys as Qa, templateResourceTypes as Qi, s3BucketWebsiteUrl as Qn, resolveStateBucketWithDefault as Qo, refuseMalformedOrphansForOrphan as Qr, withCreateTokenLedger as Qt, bold as R, STATE_SOURCED_READBACK_RULES as Ra, isWarmThroughputDecrease as Ri, assertFlagRoleArn as Rn, runDockerStreaming as Ro, malformedOutputsWarning as Rr, exportNameSecretExposure as Rt, compensateRemovedDeletionProtection as S, maskSecretsInText as Sa, unreadableOrphanRecords as Si, withIndeterminateGuard as Sn, buildDenyExternalAccessPolicy as So, hasReadableOutputs as Sr, ownValue as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, scrubResourceRecord as Ta, findSilentDropProperties as Ti, disableInstanceApiTermination as Tn, describeDockerCapturedOutput as To, isReadableResourceEntry as Tr, displayAssemblyPath as Ts, refusesFinalSnapshot as Tt, yellow as U, isLockInfoExpired as Ua, configBooleanRefusal as Ui, AWS_CREDENTIAL_ENV_KEYS as Un, getDockerImageBySourceHash as Uo, malformedScrubResourceEntriesRefusalMessage as Ur, isExportAliasCollision as Ut, green as V, isSingleDynamicReferenceToken as Va, coerceCfnBoolean as Vi, isIamRoleArn as Vn, stripControlChars as Vo, malformedResourcePropertiesWarning as Vr, collectDeclaredOutputNames as Vt, computeParameterTaint as W, S3StateBackend as Wa, configIntegerRefusal as Wi, applyCallerIdentityCredentials as Wn, Synthesizer as Wo, malformedStateRefusalMessage as Wr, bindingSkippedOutputs as Wt, NESTED_PENDING_PARENT_REASON as X, hasReasonlessBaselineRefusal as Xa, requireConfigString as Xi, s3BucketDualStackDomainName as Xn, resolveCaptureObservedState as Xo, refuseMalformedOrphans as Xr, ledgerForStack as Xt, planOrphanAdoption as Y, hasReadableExportSet as Ya, requireConfigObject as Yi, s3BucketDomainName as Yn, resolveAutoAssetStorage as Yo, refuseMalformedOrphanRecordsForDestroy as Yr, earliestDefined as Yt, dropSettledNestedJournals as Z, hasUnverifiableParameterRefusal as Za, prefetchCreateOnlyPropertyPaths as Zi, s3BucketRegionalDomainName as Zn, resolveSkipPrefix as Zo, refuseMalformedOrphansForDestroy as Zr, reserveStackCreateToken as Zt, perType as _, recordLogOnlyValue as _a, repairMalformedOutputsForReadOnly as _i, ccProtectionRegistryTypes as _n, isCrossRegionRedirect as _o, UNREADABLE_ORPHANS_CONTAINER_ROW as _r, processStackMessages as _s, inheritProducerRegions as _t, conditionInputsFrom as a, DagBuilder as aa, refuseMalformedResourceEntriesForImport as ai, tagMapAsList as an, isSensitiveAttributeName as ao, carriesFetchableDynamicReference as ar, CFN_TEMPLATE_URL_LIMIT as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, errorCauseChain as ba, repairMalformedResourcesForReadOnly as bi, deleteIndeterminateGuards as bn, validateAssetBucketName as bo, displayLogicalId as br, hasPlainPrototype$1 as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, inheritNestedStackParameterAssociations as ca, refuseMalformedResourcePropertiesForDrift as ci, stringifyIfAssigned as cn, buildAssetRedirectMap as co, AWS_NO_VALUE as cr, uploadCfnTemplate as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, createUnionSecretMasker as da, refuseMalformedResourcesForDeploy as di, ccBrokenReason as dn, rewriteTemplateAssetReferences as do, refStateLookupFromResource as dr, expectedOwnerParam as ds, recordAfterRollbackUpdate as dt, withRetry as ea, refuseMalformedOutputsForDestroy as ei, DBPROXY_TAGS_WHAT as en, isReadableBag as eo, isUnboundTemplateParameter as er, resolveUseCdkBootstrapAssets as es, revertNestedChildFromJournal as et, withResourceDeadline as f, hasMaskableValues as fa, refuseMalformedResourcesForDestroy as fi, wouldReturnToSdkProvider as fn, AssetModeResolver as fo, parseWebACLArn as fr, PARTITION_TABLE as fs, planFailedOps as ft, isProtectionValueActive as g, recordLogOnlyParameterValue as ga, repairMalformedOrphansForReadOnly as gi, slowCcOperationTimeoutMs as gn, getBootstrapMarkerKey as go, STATE_RESOURCES_MALFORMED as gr, StageLoadError as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, printingCorpusOf as ha, repairMalformedOrphanRecordsForReadOnly as hi, CloudControlProvider as hn, ensureAssetStorage as ho, STATE_REGION_DIVERGED as hr, AssemblyReader as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, sameLambdaFunctionAddress as ia, refuseMalformedResourceEntriesForDestroy as ii, refuseMalformedDesiredTags as in, AssetPublisher as io, carriesDynamicReference as ir, CFN_TEMPLATE_BODY_LIMIT as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, identityKeyFor as ja, shownType as ji, DiffCalculator as jn, getDockerCmd as jo, malformedLocalResourcesWarning as jr, extractDeploymentEventError as jt, waitForIndexesSettled as k, isUncertifiedBaselineMaskPosition as ka, hasNoCloudControlHandlers as ki, reDisableInstanceApiTermination as kn, finchSecretArgvRefusal as ko, malformedLocalOutputsWarning as kr, resolveBucketRegion as ks, DeploymentEventsReader as kt, keptWholeReasonText as l, recordNestedStackParameterExpressions as la, refuseMalformedResourcePropertiesForExport as li, CC_BROKEN_REASON as ln, createAssetRedirectResolver as lo, cfnRefValueFromPhysicalId as lr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ls, getStackRecords as lt, recordedProtectionNote as m, logOnlyValueCount as ma, refuseMalformedState as mi, getCurrentResourceSecrets as mn, assertAssetBucketRegion as mo, JSON_LISTING_HOLE_VALUE as mr, derivePartitionAndUrlSuffix as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, canonicalLambdaFunctionName as na, refuseMalformedResourceEntries as ni, planTagDiff as nn, orphansCarriedFrom as no, getAccountInfo as nr, warnDeprecatedNoPrefixCliFlag as ns, withNestedRevertRun as nt, parentSuppliedValues as o, TemplateParser as oa, refuseMalformedResourceEntriesForImportSave as oi, tagPlanWarning as on, stringifyValue as oo, isNamelessDynamicReferenceError as or, MIGRATE_TMP_PREFIX as os, replayRollback as ot, recordedProtectionEvidence as p, literalSplitDelimitersOf as pa, refuseMalformedResourcesForExport as pi, isCustomResourceType as pn, BOOTSTRAP_MARKER_PREFIX as po, withSharedDrainBudget as pr, canonicalizeRegion as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, describeRegionValueKind as qa, replayWarn as qi, isSettledInstanceState as qn, getLegacyStateBucketName as qo, refuseMalformedNestedChildOutputs as qr, maskingRetryLogger as qt, computeImplicitDeleteEdges as r, lambdaFunctionNameForMask as ra, refuseMalformedResourceEntriesForDeploy as ri, readTagList as rn, shouldRetainResource as ro, isImpossibleEmptyStoredAttribute as rr, ssmResolvedValueType as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, liveMatchesUnresolvedTokenFrame as sa, refuseMalformedResourceEntriesForOrphan as si, definedAttributes as sn, WorkGraph as so, keepsSecretReferenceToken as sr, findLargeInlineResources as ss, awaitInFlightSibling as st, DeployEngine as t, markAuxiliaryFailure as ta, refuseMalformedResourceAttributesForOrphan as ti, DBPROXY_TAG_OPTIONS as tn, orphansAfterRollback as to, parameterTypeMayLoseSecretIdentity as tr, stateBucketExistenceConfirmed as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, carryLogOnlyValues as ua, refuseMalformedResourcePropertiesForOrphan as ui, ProviderRegistry as un, loadPublishableAssetManifest as uo, isStalePlaceholderArnAttribute as ur, decodeListingKey as us, withStackRecords as ut, readProtection as v, shareLogOnlyValues as va, repairMalformedResourceEntriesForReadOnly as vi, unchangedBehindSecretReference as vn, parseBootstrapMarker as vo, UNREADABLE_RESOURCES_MAP_ROW as vr, defineOwnKey as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, redactSecretsForState as wa, findActionableSilentDrops as wi, markWaitAbandoned as wn, resolveDockerContextDirectory as wo, isReadableOrphanRecord as wr, describeFileReadFailure as ws, isFinalSnapshotError as wt, beginDeleteWait as x, maskSecretsInError as xa, unpreviewableOrphanRecords as xi, deleteSkipReason as xn, validateContainerRepoName as xo, hasReadableOrphans as xr, nullPrototypeRecord as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, createSecretMasker as ya, repairMalformedResourcePropertiesForReadOnly as yi, UNSPECIFIED_SKIP_REASON as yn, readBootstrapMarkerBody as yo, deployRefusesOrphanRowsReason as yr, hasOwnKey as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, TEMPLATE_SOURCED_RULES as za, toCfnInteger as zi, assertSendableRoleArn as zn, warnFinchArgvExposure as zo, malformedRenderedContainersWarning as zr, isWholeDynamicReferenceValue as zt };
-//# sourceMappingURL=deploy-engine-BTOCDCWf.js.map
+export { resourcesNamingDeclaredParameter as $, STATE_SOURCED_READBACK_RULES as $a, isWarmThroughputDecrease as $i, explicitRoleArnOrThrow as $n, runDockerForeground as $o, malformedOutputsWarning as $r, noEchoParameterValueSeed as $t, resolveDynamoDbDeleteBudgetClock as A, printingCorpusOf as Aa, repairMalformedOrphanRecordsForReadOnly as Ai, ccProtectionRegistryTypes as An, assertAssetBucketRegion as Ao, STATE_REGION_DIVERGED as Ar, derivePartitionAndUrlSuffix as As, ccRoutedFinalSnapshotError as At, getPriorAttempts as B, scrubResourceRecord as Ba, findSilentDropProperties as Bi, isTerminationProtectionPropagationError as Bn, resolveDockerContextDirectory as Bo, isReadableResourceEntry as Br, describeFileReadFailure as Bs, updatePartialMessage as Bt, perType as C, inheritNestedStackParameterAssociations as Ca, refuseMalformedResourcePropertiesForDrift as Ci, ProviderRegistry as Cn, WorkGraph as Co, isStalePlaceholderArnAttribute as Cr, findLargeInlineResources as Cs, resolveReplacementOldType as Ct, beginDeleteWait as D, hasMaskableValues as Da, refuseMalformedResourcesForDestroy as Di, getCurrentResourceSecrets as Dn, rewriteTemplateAssetReferences as Do, parameterInputsFor as Dr, expectedOwnerParam as Ds, ATOMIC_FINAL_SNAPSHOT_TYPES as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, createUnionSecretMasker as Ea, refuseMalformedResourcesForDeploy as Ei, isCustomResourceType as En, loadPublishableAssetManifest as Eo, withSharedDrainBudget as Er, decodeListingKey as Es, inheritProducerRegions as Et, waitForIndexesSettled as F, errorCauseChain as Fa, repairMalformedResourcesForReadOnly as Fi, withIndeterminateGuard as Fn, readBootstrapMarkerBody as Fo, displayLogicalId as Fr, hasOwnKey as Fs, unsupportedFinalSnapshotError as Ft, cyan as G, pathCrossesDottedKey as Ga, findReplacedReadersOfRecreateTargets as Gi, INTRINSIC_KEYS as Gn, finchSecretArgvRefusal as Go, malformedLocalResourceEntriesWarning as Gr, resolveBucketRegion as Gs, WITHHELD_NAME_DISPLAY as Gt, formatResourceLine as H, DYNAMIC_REFERENCE_TOKEN_SCAN as Ha, withoutSilentDropProperties as Hi, reDisableInstanceApiTermination as Hn, describeDockerExecFailure as Ho, malformedExportNamesWarning as Hr, renderAssemblyPathEscape as Hs, DeploymentEventsReader as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, maskSecretsInError as Ia, unpreviewableOrphanRecords as Ii, isWaitAbandonedError as In, validateAssetBucketName as Io, hasReadableOrphans as Ir, hasPlainPrototype$1 as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, recordMaskOnlyValue as Ja, isStatefulRecreateTargetForReplace as Ji, producerRegionsFromState as Jn, isDockerClientEnvKey as Jo, malformedOrphanRecordsWarning as Jr, secretBearing as Jt, gray as K, identityKeyFor as Ka, shownType as Ki, IntrinsicFunctionResolver as Kn, formatDockerLoginError as Ko, malformedLocalResourcesWarning as Kr, displayTextOrWithheld as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, maskSecretsInText as La, unreadableOrphanRecords as Li, markWaitAbandoned as Ln, validateContainerRepoName as Lo, hasReadableOutputs as Lr, nullPrototypeRecord as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, recordLogOnlyValue as Ma, repairMalformedOutputsForReadOnly as Mi, UNSPECIFIED_SKIP_REASON as Mn, getBootstrapMarkerKey as Mo, UNREADABLE_ORPHANS_CONTAINER_ROW as Mr, StageLoadError as Ms, effectiveDeletionPolicy as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, shareLogOnlyValues as Na, repairMalformedResourceEntriesForReadOnly as Ni, deleteIndeterminateGuards as Nn, isCrossRegionRedirect as No, UNREADABLE_RESOURCES_MAP_ROW as Nr, processStackMessages as Ns, isFinalSnapshotError as Nt, compensateRemovedDeletionProtection as O, literalSplitDelimitersOf as Oa, refuseMalformedResourcesForExport as Oi, CloudControlProvider as On, AssetModeResolver as Oo, passedParameterClassesOf as Or, PARTITION_TABLE as Os, PRE_DELETE_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, createSecretMasker as Pa, repairMalformedResourcePropertiesForReadOnly as Pi, deleteSkipReason as Pn, parseBootstrapMarker as Po, deployRefusesOrphanRowsReason as Pr, defineOwnKey as Ps, refusesFinalSnapshot as Pt, reachableDivergentParameters as Q, STATE_SOURCED_CROSS_GENERATION_RULES as Qa, coerceWarmThroughput as Qi, assertSendableRoleArn as Qn, redactedDockerCause as Qo, malformedOutputsRefusalMessage as Qr, isWholeDynamicReferenceValue as Qt, hasCdkAutoDeleteTag as R, markSameGenerationBag as Ra, unreadableResourceEntries as Ri, disableInstanceApiTermination as Rn, buildDenyExternalAccessPolicy as Ro, hasReadableResources as Rr, ownValue as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, liveMatchesUnresolvedTokenFrame as Sa, refuseMalformedResourceEntriesForOrphan as Si, CC_BROKEN_REASON as Sn, stringifyValue as So, cfnRefValueFromPhysicalId as Sr, MIGRATE_TMP_PREFIX as Ss, planRollback as St, DynamoDBGlobalTableProvider as T, carryLogOnlyValues as Ta, refuseMalformedResourcePropertiesForOrphan as Ti, wouldReturnToSdkProvider as Tn, createAssetRedirectResolver as To, parseWebACLArn as Tr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ts, getCurrentProducerRegions as Tt, createReadOnlyAttributeHealerFactory as U, dynamicReferenceTokens as Ua, NO_CC_HANDLERS_REASON as Ui, reEnableInstanceApiTermination as Un, describeDockerFailure as Uo, malformedExportSourceWarning as Ur, resolveAssemblyPath as Us, DeploymentEventsStore as Ut, markRefusedBeforeApplying as V, recoverMaskedOutput as Va, unwrittenCreateOnlyReplacement as Vi, observeThenDisableInstanceApiTermination as Vn, describeDockerCapturedOutput as Vo, malformedDriftResourcePropertiesWarning as Vr, displayAssemblyPath as Vs, updatePartialReason as Vt, bold as W, isUncertifiedBaselineMaskPosition as Wa, hasNoCloudControlHandlers as Wi, DiffCalculator as Wn, dockerSpawnEnvWithSensitive as Wo, malformedLocalOutputsWarning as Wr, clearBucketRegionCache as Ws, extractDeploymentEventError as Wt, computeParameterTaint as X, recordNoEchoAttributeValues as Xa, renderStatefulReason as Xi, applyRoleArnIfSet as Xn, partitionSensitiveEnv as Xo, malformedOrphansRefusalMessage as Xr, secretSafeKeyDisplay as Xt, yellow as Y, recordMaskOnlyValuesIn as Ya, isStatefulRecreateTargetSync as Yi, regionLessSecretName as Yn, isMalformedEnvKey as Yo, malformedOrphanRowsKeptWarning as Yr, secretBearingStateKeyWarning as Yt, namesAnyDeclaredParameter as Z, STATE_SOURCED_BASELINE_RULES as Za, WARM_THROUGHPUT_MEMBERS as Zi, assertFlagRoleArn as Zn, redactDockerArgvValues as Zo, malformedOrphansWarning as Zr, exportNameSecretExposure as Zt, makeCanonicalizePropertiesFn as _, canonicalLambdaFunctionName as _a, refuseMalformedResourceEntries as _i, refuseMalformedDesiredTags as _n, orphansAfterRollback as _o, carriesDynamicReference as _r, stateBucketExistenceConfirmed as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, configIntegerRefusal as aa, malformedStateRefusalMessage as ai, DEFAULT_RESOURCE_WARN_AFTER_MS as an, S3StateBackend as ao, envCredentialsAreAssumedRole as ar, getDockerImageBySourceHash as as, dropSettledNestedJournals as at, recordedProtectionNote as b, DagBuilder as ba, refuseMalformedResourceEntriesForImport as bi, definedAttributes as bn, AssetPublisher as bo, keepsSecretReferenceToken as br, CFN_TEMPLATE_BODY_LIMIT as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, replayWarn as ca, refuseMalformedNestedChildOutputs as ci, earliestDefined as cn, acceptedCreateOnlyDropsOf as co, s3BucketDomainName as cr, getDefaultStateBucketName as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigString as da, refuseMalformedOrphans as di, withCreateTokenLedger as dn, hasReadableExportSet as do, s3BucketWebsiteUrl as dr, resolveAutoAssetStorage as ds, withNestedRevertRun as dt, toCfnInteger as ea, malformedRenderedContainersWarning as ei, collectDeclaredOutputNames as en, TEMPLATE_SOURCED_RULES as eo, isIamRoleArn as er, runDockerStreaming as es, makeSiblingClaimReader as et, parentSuppliedValues as f, prefetchCreateOnlyPropertyPaths as fa, refuseMalformedOrphansForDestroy as fi, acquireIdempotencyToken as fn, hasReasonlessBaselineRefusal as fo, coerceParameterTypedValue as fr, resolveCaptureObservedState as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, markAuxiliaryFailure as ga, refuseMalformedResourceAttributesForOrphan as gi, readTagList as gn, isReadableBag as go, isImpossibleEmptyStoredAttribute as gr, resolveUseCdkBootstrapAssets as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, withRetry as ha, refuseMalformedOutputsForDestroy as hi, planTagDiff as hn, importableOutputs as ho, getAccountInfo as hr, resolveStateBucketWithDefaultAndSource as hs, replayRollback as ht, childTemplateLoader as i, configBooleanRefusal as ia, malformedScrubResourceEntriesRefusalMessage as ii, DEFAULT_RESOURCE_TIMEOUT_MS as in, isLockInfoExpired as io, callerEnvCredentials as ir, AssetManifestLoader as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, recordLogOnlyParameterValue as ja, repairMalformedOrphansForReadOnly as ji, unchangedBehindSecretReference as jn, ensureAssetStorage as jo, STATE_RESOURCES_MALFORMED as jr, AssemblyReader as js, createPreDeleteFinalSnapshot as jt, deleteBudgetKey as k, logOnlyValueCount as ka, refuseMalformedState as ki, slowCcOperationTimeoutMs as kn, BOOTSTRAP_MARKER_PREFIX as ko, JSON_LISTING_HOLE_VALUE as kr, canonicalizeRegion as ks, buildFinalSnapshotIdentifier as kt, templateIdentity as l, requireConfigArray as la, refuseMalformedOrphanRecords as li, ledgerForStack as ln, describeRegionValueKind as lo, s3BucketDualStackDomainName as lr, getLegacyStateBucketName as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, describeTypeWithThrottleRetry as ma, refuseMalformedOutputs as mi, DBPROXY_TAG_OPTIONS as mn, importableOutputKeys as mo, parameterTypeMayLoseSecretIdentity as mr, resolveStateBucketWithDefault as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, coerceCfnBoolean as na, malformedResourcePropertiesWarning as ni, isExportAliasCollision as nn, isSingleDynamicReferenceToken as no, AWS_CREDENTIAL_ENV_KEYS as nr, escapeRegExp$2 as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configStringRefusal as oa, previewableOrphanRecords as oi, maskingRetryLogger as on, rebuildClientForBucketRegion as oo, isSettledInstanceState as or, Synthesizer as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, templateResourceTypes as pa, refuseMalformedOrphansForOrphan as pi, DBPROXY_TAGS_WHAT as pn, hasUnverifiableParameterRefusal as po, isUnboundTemplateParameter as pr, resolveSkipPrefix as ps, withNestedStackContext as pt, green as q, carriesSecretMask as qa, MULTI_REGION_RECREATE_BLOCKED_TYPES as qi, classifyReplaySecretRegion as qn, getDockerCmd as qo, malformedOrphanRecordsRefusalMessage as qr, exportAliasCollisionScrubWarning as qt, computeImplicitDeleteEdges as r, coerceCfnInteger as ra, malformedResourcesWarning as ri, bindingSkippedOutputs as rn, LockManager as ro, applyCallerIdentityCredentials as rr, stripControlChars as rs, displacedOpClause as rt, listNestedTemplateRows as s, readConfigString as sa, refuseDivergentRecordRegionForDestroy as si, RollbackInlinePolicyWriters as sn, splitImportedOps as so, s3BucketArn as sr, synthesisStatusMessage as ss, nestedChildStackName as st, DeployEngine as t, toFiniteNumber as ta, malformedResourceEntriesWarning as ti, collectPublishedOutputNames as tn, WHOLE_DYNAMIC_REFERENCE_PATTERN as to, sendableAssumeRoleCommand as tr, warnFinchArgvExposure as ts, planOrphanAdoption as tt, conditionFingerprint as u, requireConfigObject as ua, refuseMalformedOrphanRecordsForDestroy as ui, reserveStackCreateToken as un, exportNamesCarriedFrom as uo, s3BucketRegionalDomainName as ur, resolveApp as us, revertedNestedRowIds as ut, withResourceDeadline as v, lambdaFunctionNameForMask as va, refuseMalformedResourceEntriesForDeploy as vi, tagMapAsList as vn, orphansCarriedFrom as vo, carriesFetchableDynamicReference as vr, warnDeprecatedNoPrefixCliFlag as vs, getStackRecords as vt, readProtection as w, recordNestedStackParameterExpressions as wa, refuseMalformedResourcePropertiesForExport as wi, ccBrokenReason as wn, buildAssetRedirectMap as wo, refStateLookupFromResource as wr, uploadCfnTemplate as ws, findNestedStackTypeChanges as wt, PROTECTION_PROPERTY_BY_TYPE as x, TemplateParser as xa, refuseMalformedResourceEntriesForImportSave as xi, stringifyIfAssigned as xn, isSensitiveAttributeName as xo, AWS_NO_VALUE as xr, CFN_TEMPLATE_URL_LIMIT as xs, planFailedOps as xt, recordedProtectionEvidence as y, sameLambdaFunctionAddress as ya, refuseMalformedResourceEntriesForDestroy as yi, tagPlanWarning as yn, shouldRetainResource as yo, isNamelessDynamicReferenceError as yr, ssmResolvedValueType as ys, withStackRecords as yt, isTruthyCfnBoolean as z, redactSecretsForState as za, findActionableSilentDrops as zi, ec2InstanceProtectionSite as zn, buildDockerImage as zo, isReadableOrphanRecord as zr, absoluteAssemblyPathEscape as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-CMRU0DTu.js.map